jenkins-control-plugin
jenkins-control-plugin copied to clipboard
MCMicS
CSRF enabled -> Missing or bad crumb data if use Redirect to other Port
If you use an Apache with Redirect Port 80 --> 8080 and use APi Token without Crumb Token you will receive followong error:
org.codinjutsu.tools.jenkins.security.AuthenticationException: CSRF enabled -> Missing or bad crumb data
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.checkResponse(DefaultSecurityClient.java:150)
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.runMethod(DefaultSecurityClient.java:124)
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.execute(DefaultSecurityClient.java:68)
at org.codinjutsu.tools.jenkins.logic.RequestManager.loadJenkinsView(RequestManager.java:123)
at org.codinjutsu.tools.jenkins.logic.RequestManager.loadJenkinsView(RequestManager.java:279)
at org.codinjutsu.tools.jenkins.view.BrowserPanel.loadJobs(BrowserPanel.java:472)
In password field.
In some of next release we will document this in UI. Something like Password/Token
No problem If it not work please ask again. We also have an gitter for discuss problems
I figured it out 2 seconds before I read your answer :) I was trying to fit it into crumb field...
Update: It appears the stack trace is generated when submitting the correct, but not working crumb, and clicking OK to close the Jenkins Control Plugin configuration section, then clicking the "Refresh latest builds" button, not the Test Connection button. No stack trace is generated when clicking Test Connection, only the error message.
I'm getting the same "[Fail] CSRF enabled -> Missing or bad crumb data" but without Apache and a different stack trace.
I am running Jenkins 2.222.1 on Ubuntu 18.04. I installed IntelliJ and the Jenkins Control Plugin (0.12.0-2019.3). When I enter the crumb data from http://jenkins-url:8080/crumbIssuer/api/xml?tree=crumb and click Test Connection, I get the error.
IntelliJ IDEA Details IntelliJ IDEA 2020.1 (Community Edition) Build #IC-201.6668.121, built on April 8, 2020 Runtime version: 11.0.6+8-b765.25 amd64 VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o Linux 5.3.0-46-generic GC: ParNew, ConcurrentMarkSweep Non-Bundled Plugins: Jenkins Control Plugin, training, Stapler plugin for IntelliJ IDEA, com.thvardhan.gradianto, com.vincentp.gruvbox-theme, BashSupport, com.jetbrains.edu, some.awesome Current Desktop: MATE
Stack Trace
org.codinjutsu.tools.jenkins.security.AuthenticationException: CSRF enabled -> Missing or bad crumb data
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.checkResponse(DefaultSecurityClient.java:150)
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.runMethod(DefaultSecurityClient.java:124)
at org.codinjutsu.tools.jenkins.security.DefaultSecurityClient.execute(DefaultSecurityClient.java:68)
at org.codinjutsu.tools.jenkins.logic.RequestManager.loadJenkinsRssLatestBuilds(RequestManager.java:115)
at org.codinjutsu.tools.jenkins.logic.RssLogic.loadAndReturnNewLatestBuilds(RssLogic.java:91)
at org.codinjutsu.tools.jenkins.logic.RssLogic.access$000(RssLogic.java:48)
at org.codinjutsu.tools.jenkins.logic.RssLogic$LoadLatestBuildsJob.run(RssLogic.java:189)
at com.intellij.openapi.progress.impl.CoreProgressManager$TaskRunnable.run(CoreProgressManager.java:930)
at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcessWithProgressAsync$5(CoreProgressManager.java:432)
at com.intellij.openapi.progress.impl.ProgressRunner.lambda$null$3(ProgressRunner.java:233)
at com.intellij.openapi.progress.impl.CoreProgressManager.lambda$runProcess$2(CoreProgressManager.java:164)
at com.intellij.openapi.progress.impl.CoreProgressManager.registerIndicatorAndRun(CoreProgressManager.java:625)
at com.intellij.openapi.progress.impl.CoreProgressManager.executeProcessUnderProgress(CoreProgressManager.java:570)
at com.intellij.openapi.progress.impl.ProgressManagerImpl.executeProcessUnderProgress(ProgressManagerImpl.java:61)
at com.intellij.openapi.progress.impl.CoreProgressManager.runProcess(CoreProgressManager.java:151)
at com.intellij.openapi.progress.impl.ProgressRunner.lambda$submit$4(ProgressRunner.java:233)
at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:834)
Is this the appropriate location to post this, or would you prefer a new issue?
Hi @jep, since jenkins 2.176.2 the crumb not work anymore in this way. We should keep the session because:
CSRF tokens (crumbs) are now only valid for the web session they were created in to limit the impact of attackers obtaining them
Jenkins say that;
Scripts could instead use an API token, which has not required a CSRF token (crumb) since Jenkins 2.96.
So it is recommend to use a API Token instead a password. then you can work without a crumb.
see #173
Hope it helps.
I will update the UI in one of next release to change password with API Token to clarify this
Hi @jep, since jenkins 2.176.2 the crumb not work anymore in this way. We should keep the session because:
CSRF tokens (crumbs) are now only valid for the web session they were created in to limit the impact of attackers obtaining them
Jenkins say that;
Scripts could instead use an API token, which has not required a CSRF token (crumb) since Jenkins 2.96.
So it is recommend to use a API Token instead a password. then you can work without a crumb.
see #173
Hope it helps.
I will update the UI in one of next release to change password with API Token to clarify this
I apologize for overlooking this. Your suggestion resolved the issue. Thank you for your quick response!
improved redirect handling with 0.13.17
If there are still issues please reopen or file new issue