I need to disable the CSRF protection in jenkins, which is enabled by default. The problem is after containerizing this, when ever i spun up a new container with jenkins inside it, it throws a "No valid crumb " error.

i am currenty using this cmd to turn on the jenkins application.

/usr/bin/java  -server -Djava.net.preferIPv4Stack=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration=false  -jar /usr/share/jenkins/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=9090 --ajp13Port=-1
  • 1
    "Manage Jenkins" > "Configure Global Security": is "Prevent Cross Site Request Forgery exploits" selected? If it is, deselect it.
    – hoefling
    May 19 '18 at 12:37
  • I need a cli based cmd to disable that,, as the Jenkins is running behind kube proxy it keeps on crashing during the initial installation... May 19 '18 at 23:04
  • 2
    fwiw, the option "Manage Jenkins" > "Configure Global Security": is "Prevent Cross Site Request Forgery exploits" doesn't exist/is missing on our Jenkins 2.233 instance. Apr 29 '20 at 21:44

To disable CSRF, it can be done with groovy, open "Manage Jenkins" / "Script Console"

import jenkins.model.Jenkins
def instance = Jenkins.instance

Source: https://stackoverflow.com/a/57869141

  • 1
    How to do this permanently? The above changes are going off after restarting the Jenkins. Aug 4 '20 at 13:08
  • You can create a Groovy script file $JENKINS_HOME/init.groovy, or any .groovy file in the directory $JENKINS_HOME/init.groovy.d/, to run some additional things right after Jenkins starts up.
    – RoyHu
    Sep 27 '20 at 8:58

I just add


So the full command is:

docker run  --restart=always --name jenkins --add-host="xxxx:xx" --add-host="updates.jenkins-ci.org:" --add-host="updates.jenkins.org:"  -u root  -d -p 8080:8080 -p 50000:50000  -v /root/jenkins-data:/var/jenkins_home -v /var/run/docker.sock:/var/run/docker.sock   -e JAVA_OPTS="-Duser.timezone=Asia/Shanghai -Dhudson.model.DownloadService.noSignatureCheck=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true"  docker.io/jenkins/jenkins:lts

enter image description here


Adding to @hoefling, after the "Prevent Cross Site Request Forgery" parameter is deselected. Save it.

Goto Manage Jenkins and click on Reload Configuration from Disk.


Not 100% sure about your use case, but you always have the option of creating a new Docker image using a Dockerfile and running that image instead. In the Dockerfile, you'd set your system properties using the JAVA_OPTS environment variable.

FROM jenkins/jenkins:latest
ENV JAVA_OPTS -Djava.net.preferIPv4Stack=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration=false

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.