Http error 403 no valid crumb was included in the request jenkins

Finally, this post helped me to do away with the crumb problem, but still securing Jenkins from a CSRF attack.

Solution for no-valid crumb included in the request issue

Basically, we need to first request for a crumb with authentication and then issue a POST API calls with a crumb as a header along with authentication again.

This is how I did it,

curl -v -X GET http://jenkins-url:8080/crumbIssuer/api/json --user <username>:<password>

The response was,

{
"_class":"hudson.security.csrf.DefaultCrumbIssuer",
"crumb":"0db38413bd7ec9e98974f5213f7ead8b",
"crumbRequestField":"Jenkins-Crumb"
}

Then the POST API call with the above crumb information in it.

curl -X POST http://jenkins-url:8080/job/<job-name>/build --user <username>:<password> -H 'Jenkins-Crumb: 0db38413bd7ec9e98974f5213f7ead8b'

This solution is safe to use

We came along this issue when we changed Jenkins to be accessible via a reverse proxy.

There is an option in the «Configure Global Security» that «Enable proxy compatibility«

This helped with my issue.

Another solution

In the GitHub payload URL, make your URL look like this:
https://jenkins:8080/github-webhook/

Don’t forget to mention / at the end.

To resolve this issue I unchecked «Prevent Cross Site Request Forgery exploits» in jenkins.com/configureSecurity section and it started working.

answered Jun 24, 2017 at 4:19

I solved this by using an API token as a basic authentication password. Here is how:

curl -v -X POST http://jenkins-url:8080/job/<job-name>/buildWithParameters?param=value --user <username>:<token>

Note: To create the API token under the accounts icon → Configure → API Token → Add New token.

A crumb is nothing but an access token. Below is the API to get the crumb:

https://jenkins.xxx.xxx.xxx/crumbIssuer/api/json
// Replace it with your Jenkins URL and make a GET call in your Postman or REST API caller.

This will generate output like:

{
    "_class": "hudson.security.csrf.DefaultCrumbIssuer",
    "crumb": "ba4742b9d92606f4236456568a",
    "crumbRequestField": "Jenkins-Crumb"
}

Below are more details and link related to same:
How to request for the crumb issuer for Jenkins

Jenkins wiki page.

If you are calling the same via REST API call, checkout the below link where it is explained how to do a REST call using jenkins-crumb.

How to update a Jenkins job posting config.xml

Example:

curl -X POST http://anthony:anthony@localhost:8080/jenkins/job/pof/config.xml --data-binary "@config.xml" -data ".crumb=6bbabc426436b72ec35e5ad4a4344687"

For the new release of Jenkins you should follow the solution below:

From Upgrading to Jenkins 2.176.3:

Upgrading to Jenkins 2.176.2 Improved CSRF protection

SECURITY-626

CSRF tokens (crumbs) are now only valid for the web session they were
created in to limit the impact of attackers obtaining them. Scripts
that obtain a crumb using the /crumbIssuer/api URL will now fail to
perform actions protected from CSRF unless the scripts retain the web
session ID in subsequent requests. Scripts could instead use an API
token, which has not required a CSRF token (crumb) since Jenkins 2.96.

To disable this improvement you can set the system property
hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID to true.
Alternatively, you can install the Strict Crumb Issuer Plugin which
provides more options to customize the crumb validation. It allows
excluding the web session ID from the validation criteria, and instead
e.g. replacing it with time-based expiration for similar (or even
better) protection from CSRF

In my case, it helped for the installation of the Strict Crumb Issuer Plugin, rebooting Jenkins and applying a less strict policy for the web interface of Jenkins as it is suggested on the vendor’s site.

According to Jenkins Directive
First you have to check your Jenkins version if the version is < 2.176.2 then per Jenkins guideline CSRF tokens (crumbs) are now only valid for the web session they were created in to limit the impact of attackers obtaining them. Scripts that obtain a crumb using the /crumbIssuer/api URL will now fail to perform actions protected from CSRF unless the scripts retain the web session ID in subsequent requests.

Alternatively, you can install the Strict Crumb Issuer Plugin which provides more options to customize the crumb validation. It allows excluding the web session ID from the validation criteria, and instead e.g. replacing it with time-based expiration for similar (or even better) protection from CSRF.

Steps :

• you have to installed the plugin called «Strict Crumb Issuer»
• Once installed restart the jenkins service
• got to «Manage Jenkins» —> «Configure Global Security» —> Under CSRF Protection, select «Strict Crumb Issue» from the drop down list —> Click on Advance and uncheck everything but select «Prevent Breach Attack» option. —> Apply and save.
• Now run you crumb script.

It should work now.

Check this image for your reference

answered Jul 17, 2020 at 16:03

answered Mar 9, 2021 at 18:13

I did get the same «403 No valid crumb was included in request» error when I created a Jenkins job from a Java program using jenkins-client library, i.e., com.offbytwo.jenkins. Then I used the Jenkins API token instead of password in the following code. Now, the issue is fixed.

JenkinsServer jServer = new JenkinsServer(new URI(jenkins_url), jnkn_username, jnkn_password);

We can generate an API token from the Jenkins console. Profile → Configure → API Token (Add new token).

The same API token can also be used instead of a password with curl.

curl -v -X POST http://jenkins-url:port/job/<job-name>/buildWithParameters?param=value --user <jen_username>:<jenkins_api_token>

I lost a bunch of time trying to figure this out. At the end, I just installed the plugin Build Authorization Token Root and enabled build permissions to anonymous users.

At the end doesn’t really matter, because the Jenkins instance is behind a VPN and I’m using https://smee.io to forward the webhook to the Jenkins instance.

Also the Jenkins instance is behind a reverse proxy, so the «Enable proxy compatibility» option is checked as well, and the «ignore_invalid_headers» setting set to off in the Nginx configuration at the server level. I am sharing my solution just in case someone else is struggling as well. I’m sure there are better ways to do it, but this is one option.

Note that with this plugin the build URL is set to buildByToken/build?job=JobName&token=TokenValue and the token is generated in the job settings.

This is in Jenkins 2.235.2 which doesn’t have an option to disable CSRF.

answered May 22, 2020 at 7:25

answered Mar 14, 2022 at 14:04

answered Nov 18, 2022 at 9:10

answered Oct 13, 2022 at 19:25

answered May 5, 2022 at 16:59

answered May 19, 2021 at 11:38

answered Feb 4, 2021 at 11:09

answered Nov 2, 2020 at 13:07

answered Oct 7, 2020 at 13:44

answered Jan 26, 2021 at 9:17

answered Aug 9, 2020 at 17:38

First create a user API token by going to user → API Token → Add new token.

Then use the below script for triggering.

import jenkins,requests

job_name='sleep_job'
jenkins_url = "http://10.10.10.294:8080"
auth = ("jenkins","1143e7efc9371dde2e4f312345bec")
request_url = "{0:s}/job/{1:s}/buildWithParameters".format(jenkins_url,
job_name, )
crumb_data = requests.get("{0:s}/crumbIssuer/api/json".format(jenkins_url),
auth=auth, ).json()
headers = {'Jenkins-Crumb': crumb_data['crumb']}
jenkins_job_params={}
jenkins_job_params['NODE_NAME']='10_10_1_29'
jenkins_job_params['SLEEP_TIME']='1h'
response = requests.post(request_url, data=jenkins_job_params, auth=auth, )
response.raise_for_status()

answered Mar 5, 2020 at 16:58