Demo Jenkins CSRF CRUMB

In this guide, we’ll walk through generating and using Jenkins CSRF crumb tokens to secure HTTP requests against Cross-Site Request Forgery attacks. You’ll learn how to configure Jenkins for CSRF protection, retrieve crumb tokens via the REST API, and trigger jobs with the proper headers and cookies.

Jenkins CSRF Protection Configuration

By default, Jenkins enforces CSRF protection. As an administrator:

1. Go to Manage Jenkins → Configure Global Security.
2. Locate the CSRF Protection section and confirm it is enabled.

hudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION=true

Default Crumb Issuer

Jenkins’s Default Crumb Issuer generates a token hash from several session-specific values. All must match when validating an incoming request:

Working with the Crumb Issuer API

The crumb is exposed at the REST endpoint /crumbIssuer/api/json. Authenticate with username/password or API token to receive:

• A JSON payload containing the crumb and header field name
• A session cookie to include on subsequent requests

1. Generate and View the Crumb

curl -s \
  -u admin:password \
  http://localhost:8080/crumbIssuer/api/json | jq

{
  "_class": "hudson.security.csrf.DefaultCrumbIssuer",
  "crumb": "628e6eb7b759cb388daec3a44de4e1fcde5da95edcbd779d8b9967c1239de5cff",
  "crumbRequestField": "Jenkins-Crumb"
}

2. Inspect Response Headers

View the Set-Cookie header to capture the session ID:

curl -s -v \
  -u admin:password \
  http://localhost:8080/crumbIssuer/api/json > /dev/null

Example header output:

Set-Cookie: JSESSIONID.<...>=node01ylzmgr6pjx...; Path=/; HttpOnly

3. Store Cookies with a Cookie Jar

Save the session cookie for later use:

curl -s \
  -u admin:password \
  --cookie-jar /tmp/jenkins_cookies \
  http://localhost:8080/crumbIssuer/api/json | jq

{
  "_class": "hudson.security.csrf.DefaultCrumbIssuer",
  "crumb": "28791665a0a7f47ecf03510ae3b0b2695e01d3e3f2d0ba96d1d230898051059a",
  "crumbRequestField": "Jenkins-Crumb"
}

Verify the stored cookie:

cat /tmp/jenkins_cookies

Triggering a Parameterized Job with the Crumb

With both the crumb token and session cookie saved, you can trigger a build:

curl -s \
  -u admin:password \
  --cookie /tmp/jenkins_cookies \
  -H "Jenkins-Crumb: <crumb_value>" \
  -X POST "http://localhost:8080/job/parameterized-pipeline-job/buildWithParameters" \
  -d BRANCH_NAME=test \
  -d APP_PORT=6767

After execution, verify the new build appears in the Jenkins UI.

Alternative: API Token Authentication

If managing cookies and crumbs is cumbersome, switch to API token authentication. Requests using an API token are automatically exempt from CSRF checks, streamlining your CI/CD scripts.

Links and References

• Jenkins CSRF Protection
• Jenkins REST API
• Continuous Integration Best Practices