Redirect 'CSRF Protection' wiki page to jenkins.io

[MarkEWaite]

Use the documentation page conversion instructions to redirect CSRF Protection from the wiki to jenkins.io.

The existing page is outdated and incomplete. It should redirect to the https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery.

A wiki.jenkins.io redirect is the last step in migrating from wiki.jenkins.io to www.jenkins.io. Submit a pull request to jenkins-infra/.../vhost.conf that is modeled after previous pull requests like PR-1467.

[LarrySul]

Hi @oleg-nenashev looking to contribute to jenkins and I have gone through the contribution guide, permission to take this issue up

[oleg-nenashev]

@LarrySul Hi, thanks for the interest!
I think that this particular page has been already migrated: https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery though it needs to be update for recent Jenkins versions which enable CSRF by default.

I would suggest to...

• Update https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery to reflect the status of the Jenkins core
• Setup a Wiki redirect for this page in https://github.com/jenkins-infra/jenkins-infra/blob/staging/dist/profile/templates/confluence/vhost.conf

CC @MarkEWaite @Wadeck @daniel-beck

[daniel-beck]

AFAICT the wiki page is completely irrelevant right now after recent changes, and existing documentation elsewhere should be updated or just written from scratch.

Some (actually useful) references:

• https://www.jenkins.io/changelog/#v2.222 made the crumb issuer always present, it no longer needs to be enabled. https://www.jenkins.io/doc/upgrade-guide/2.222/#always-enabled-csrf-protection explains some compatibility considerations.
• Since https://www.jenkins.io/changelog-old/#v2.96 the remote API no longer requires crumbs when using API tokens instead of passwords for authentication. https://www.jenkins.io/doc/upgrade-guide/2.176/#SECURITY-626 explains limitations when trying to use the remote API with a password in recent releases.

[MarkEWaite]

@LarrySul are you willing to consider implementing this issue with its redefined scope?

I'd be happy to code review the pull request to the jenkins-infra/jenkins-infra repository that would add a redirect from the wiki page for CSRF protection to the existing documentation.

I created a separate GitHub issue to resolve the larger topics that have been identified by @daniel-beck . It is #3265

[LarrySul]

@MarkEWaite I'm open to learning how to implement the issue with the redefined scope under your guidance. I got lost for the moment but we can get started right away, I already cloned the repository

[MarkEWaite]

That would be great @LarrySul . Thanks for being the "test case" for a revision of the instructions that I'm preparing for a jenkins.io pull request.

Redirecting a wiki page

Wiki pages are migrated one at a time. When the content of a wiki page has been migrated from wiki.jenkins.io and merged into www.jenkins.io, we can "hide" the wiki page by redirecting all requests for that page to the replacement page on www.jenkins.io. A page redirect pull request is used to define that redirect.

Wiki page redirect pull request

1. Prepare a change for the jenkins-infra/jenkins-infra repository that will add two new lines of data to the vhost.conf file on the staging branch. The pull request should add to either the "Non plugin rewrites" section or the "Developer documentation" section of the vhost.conf file. The destinoatino section depends on the content of the page being redirected
2. The data to be added will look something like this:

RewriteCond %{HTTP_USER_AGENT} !^jenkins-wiki-exporter/(.*)$
RewriteRule "^/display/JENKINS/CSRF\+Protection$" "https://www.jenkins.io/doc/book/managing/security/#cross-site-request-forgery" [NE,NC,L,QSA,R=301]

3. Submit the pull request to the jenkins-infra/jenkins-infra repository repository with those two lines of data

[MarkEWaite]

@LarrySul thanks again for being willing to "test drive" those instructions. If you can share your experience trying to follow those instructions, it will help me refine them so that others have a better experience.

We could also sit together on a Zoom video call if Zoom works in your area.

[LarrySul]

@MarkEWaite I have been able to complete the assigned task and made a PR for your reference the issue can be found here. The insructions were very much detailed enough and I only needed to spend few mins trying to figure out what was needed to be done. Thank you

[MarkEWaite]

Redirect is complete and confirmed it is working as expected. Thanks @LarrySul

[LarrySul]

@MarkEWaite My pleasure