13

I need to disable the CSRF protection in jenkins, which is enabled by default. The problem is after containerizing this, when ever i spun up a new container with jenkins inside it, it throws a "No valid crumb " error.

i am currenty using this cmd to turn on the jenkins application.

/usr/bin/java  -server -Djava.net.preferIPv4Stack=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration=false  -jar /usr/share/jenkins/jenkins.war --webroot=/var/cache/jenkins/war --httpPort=9090 --ajp13Port=-1
Improve this question
3
  • 1
    "Manage Jenkins" > "Configure Global Security": is "Prevent Cross Site Request Forgery exploits" selected? If it is, deselect it.
    – hoefling
    May 19, 2018 at 12:37
  • I need a cli based cmd to disable that,, as the Jenkins is running behind kube proxy it keeps on crashing during the initial installation...
    – Mohammed Ali
    May 19, 2018 at 23:04
  • 2
    fwiw, the option "Manage Jenkins" > "Configure Global Security": is "Prevent Cross Site Request Forgery exploits" doesn't exist/is missing on our Jenkins 2.233 instance.
    – Elijah Lynn
    Apr 29, 2020 at 21:44

4 Answers 4

Reset to default
14

To disable CSRF, it can be done with groovy, open "Manage Jenkins" / "Script Console"

import jenkins.model.Jenkins
def instance = Jenkins.instance
instance.setCrumbIssuer(null)

Source: https://stackoverflow.com/a/57869141

Improve this answer
2
  • 1
    How to do this permanently? The above changes are going off after restarting the Jenkins.
    – Prabhu Vignesh Rajagopal
    Aug 4, 2020 at 13:08
  • You can create a Groovy script file $JENKINS_HOME/init.groovy, or any .groovy file in the directory $JENKINS_HOME/init.groovy.d/, to run some additional things right after Jenkins starts up.
    – RoyHu
    Sep 27, 2020 at 8:58
1

I just add

-Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true

So the full command is:

docker run  --restart=always --name jenkins --add-host="xxxx:xx" --add-host="updates.jenkins-ci.org:7.223.199.227" --add-host="updates.jenkins.org:7.223.199.227"  -u root  -d -p 8080:8080 -p 50000:50000  -v /root/jenkins-data:/var/jenkins_home -v /var/run/docker.sock:/var/run/docker.sock   -e JAVA_OPTS="-Duser.timezone=Asia/Shanghai -Dhudson.model.DownloadService.noSignatureCheck=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true"  docker.io/jenkins/jenkins:lts

enter image description here

Improve this answer
0

Adding to @hoefling, after the "Prevent Cross Site Request Forgery" parameter is deselected. Save it.

Goto Manage Jenkins and click on Reload Configuration from Disk.

Improve this answer
0

Not 100% sure about your use case, but you always have the option of creating a new Docker image using a Dockerfile and running that image instead. In the Dockerfile, you'd set your system properties using the JAVA_OPTS environment variable.

FROM jenkins/jenkins:latest
ENV JAVA_OPTS -Djava.net.preferIPv4Stack=true -Dhudson.security.csrf.GlobalCrumbIssuerConfiguration=false
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .