[JIRA] (JENKINS-60524) Clarification on 'Improved CSRF protection for Jenkins 2.176.2'

[wfollon...@cloudbees.com (JIRA)]

Title: Message Title

Wadeck Follonier edited a comment on JENKINS-60524   Re: Clarification on 'Improved CSRF protection for Jenkins 2.176.2' Hello [~n_kanekar], Not sure creating a ticket for that is relevant, it seems a mail to the dev list is better suited. Anyway, I will reply here ;) 1) There was no major issue before. The goal here is to limit the attack surface. If you steal a CSRF token (no known vulnerability to achieve that at the moment), the user had no way to "revoke" it. With the session binding, re-logging is a way to more forward. Think about it as an additionnal layer of protection that you do not need right now, but will happy to have if your token is compromised ;) 2) We really try hard to never break features during a security update, but sometime we have to correct some less secure behavior (or totally insecure one) and for those situations we are providing a way for legacy configuration to still work. It's highly recommended to not use the escape hatches for the long run but more for a short period of time, to have the time to adjust internal stuff etc. There is no plan yet to remove the previous escape hatches, but it's not meant to be used forever. We will perhaps use some telemetry to understand which ones are really used or not and remove the unused ones. If you have a particular situation when the session ID binding is important to not be used, please explain your scenario for us to better understand and perhaps to propose a different approach. (feel free to re-open the ticket + ping me if you want to reply, I will not actively watch this ticket) Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.203623.1576664255000.13979.1576835160535%40Atlassian.JIRA.