Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-76118

Toggle collapse links can trigger 404 errors when clicked before page scripts finish loading (Chrome-specific, regression in 2.500)

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • core
    • None
    • Starting with Jenkins 2.500, in Google Chrome.

      When using the “collapse/expand” toggle links (e.g. Build Queue), clicking the button before the page has fully loaded can trigger a 404 error in Chrome. This is a regression introduced in Jenkins 2.500 by commit 84ef1a4d4db1, which changed the doToggleCollapse endpoint from GET to POST for security reasons.

      Steps to reproduce

      1. Open the Jenkins dashboard in Chrome under a slow network or with a heavy page load.
      1. As soon as the toggle button (e.g. Build Queue) appears, click it immediately, before the page finishes loading.
      1. The request sent is a GET to doToggleCollapse, resulting in a 404 Not Found.
      1. If the same button is clicked after the page has fully loaded, the request is correctly sent as a POST and works.
      1. In Firefox, this cannot be reproduced because the button is not made clickable until scripts are ready.

      Technical details

      • The toggle is rendered in Jelly as a plain anchor tag:
        <a class="collapse post" href="${rootURL}/toggleCollapse?paneId=executors">
      • By default, this issues a GET.
        • Creates a temporary <form>
        • Sets method to POST
        • Adds the crumb
        • Submits the form, preventing the default click
      • In Chrome, because of progressive rendering, the link becomes clickable before this handler is attached → early click = raw GET → 404.

      Expected behavior

      • The toggle button should never issue a GET.
      • Clicking it at any time, regardless of page load state or browser, should result in a POST.

      Possible solutions (ideas)

      • Render the link as inactive until the JS handler is bound (e.g. remove href until ready, or mark disabled).
      • Replace `@POST` with `@RequirePOST` which doesn't really solve the problem but makes it less broken.
      • UI improvement rendering a loader of some sort until the component is fully loaded, to avoid displaying partially a component that isn't ready yet?

       


      Thanks a lot for all your work!

            minutehand Amritanshu
            aneveux Antoine Neveux
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: