Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: As of https://github.com/jenkinsci/jenkins/pull/1319 the crumb name is no longer an issue

...

To protect against this class of attacks, go to "Manage Jenkins" > "Configure Global Security" and select "Prevent Cross Site Request Forgery exploits." This option is enabled by default in new installations starting Jenkins 2.x, but if you are still on 1.x or upgrading existing installations to 2.x, this option is off by default.

Gotchas

...

Or with groovy:

Code Block
languagegroovy
titlecsrf.groovy
import hudson.security.csrf.DefaultCrumbIssuer
import jenkins.model.Jenkins

def instance = Jenkins.instance
instance.setCrumbIssuer(new DefaultCrumbIssuer(true))
instance.save()

Gotchas

  • If you have scripts and other programs that access Jenkins via REST API, they can be impacted. See its CSRF section for more information about how to update those scripts.