[JIRA] (JENKINS-59229) csrf protection too strict?

[heyl...@gmail.com (JIRA)]

Title: Message Title

Jan Heylen created an issue   Jenkins / JENKINS-59229 csrf protection too strict? Issue Type: Bug Assignee: Unassigned Components: core Created: 2019-09-04 16:06 Environment: jenkins 2.176.3 lts docker image Labels: security Priority: Major Reporter: Jan Heylen tested as follows with 2.176.2 successfully: wget -q --auth-no-challenge --user jheylen --password XXXXXX --output-document - 'http://jenkins/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)'  crumb=Jenkins-Crumb:1e7fe08f74e2ad6814e309af63986292 curl -X POST -H Jenkins-Crumb:1e7fe08f74e2ad6814e309af63986292 --silent --basic -u jheylen:XXXXXXX 'http://jenkins/me/descriptorByName/jenkins.security.ApiTokenProperty/generateNewToken?newTokenName=temp' API_token=1103e007f9659c28d25ee... But with 2.176.3, we get: Sep 04, 2019 3:51:40 PM hudson.security.csrf.CrumbFilter doFilter WARNING: Found invalid crumb 22bdf12008e1ee08ae29a897a00f669d. Will check remaining parameters for a valid one... Sep 04, 2019 3:51:40 PM hudson.security.csrf.CrumbFilter doFilter WARNING: No valid crumb was included in request for /descriptorByName/hudson.security.LDAPSecurityRealm$CacheConfiguration/fillTtlItems by jheylen. Returning 403. for every crumb retrieved with above workflow. Is this an issue in 2.176.3, or are we using the api/crumb in a wrong way?   Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.201686.1567613166000.6713.1567613220126%40Atlassian.JIRA.