Skip to content

[JENKINS-12875] "No valid crumb was included in the request" errors all around #12482

Closed
Bug
Closed
[JENKINS-12875] "No valid crumb was included in the request" errors all around#12482
Bug
Labels
component:coreimported-jira-issuepriority:criticalresolution:fixed

Description

@jenkins-infra-bot
jenkins-infra-bot
opened on Feb 23, 2012

After upgrading Jenkins from 1.448 to 1.451 (with yum, upgraded plugins too) several parts of Jenkins have become unusable with error "No valid crumb was included in the request":

Console output

  • When building, the log is unavailable, see console_log.png
  • Once the build is done, the complete log is available, but the same error appears on the side console_side.png

Build configuration

  • Builds cannot be launched anymore from the build page (The firebug error console displays the "No valid crumb was included in the request" error). They still can be launched from the dashboard though.
  • Cannot add build steps (when choosing a build step type an error is reported in background), see add_build_step.png

Manage Jenkins configuration

  • The page loads only partially (first half is permanently greyed out, see configuration.png). The firebug error console displays the "No valid crumb was included in the request" error.

Manage Jenkins plugins

  • Cannot upgrade nor downgrade, see error shown plugins.png
Originally reported by naloy, imported from: "No valid crumb was included in the request" errors all around
  • assignee: danielbeck
  • status: Resolved
  • priority: Critical
  • component(s): core
  • label(s): 2.0, 2.0-planned, crumb
  • resolution: Fixed
  • resolved: 2016-04-01T23:57:26+00:00
  • votes: 20
  • watchers: 43
  • imported: 2025-11-24
Raw content of original issue 
After upgrading Jenkins from 1.448 to 1.451 (with yum, upgraded plugins too) several parts of Jenkins have become unusable with error "No valid crumb was included in the request":



Console output



    
	
  • When building, the log is unavailable, see console_log.png
    • 
	
  • Once the build is done, the complete log is available, but the same error appears on the side console_side.png
    • 





Build configuration



    
	
  • Builds cannot be launched anymore from the build page (The firebug error console displays the "No valid crumb was included in the request" error). They still can be launched from the dashboard though.
    • 
	
  • Cannot add build steps (when choosing a build step type an error is reported in background), see add_build_step.png
    • 





Manage Jenkins configuration



    
	
  • The page loads only partially (first half is permanently greyed out, see configuration.png). The firebug error console displays the "No valid crumb was included in the request" error.
    • 





Manage Jenkins plugins



    
	
  • Cannot upgrade nor downgrade, see error shown plugins.png
    •
  • environment: CentOS release 5.5 (Final) 64b
6 attachments

Activity

  1. jenkins-infra-bot commented on Feb 23, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 23, 2012
    Author

    • Remote link associated with this issue:

  2. jenkins-infra-bot commented on Feb 27, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 27, 2012
    Author
    naloy:
    • Original comment link
    • Raw content of original comment: 
      After yet another restart things seems to be back to normal (???!!)

    After yet another restart things seems to be back to normal (???!!)

  3. jenkins-infra-bot commented on Feb 27, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 27, 2012
    Author
    valentine:
    • Original comment link
    • Raw content of original comment: 
      Not completely normal. The loading thing in the management section is still happening

    Not completely normal. The loading thing in the management section is still happening

  4. jenkins-infra-bot commented on Feb 27, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 27, 2012
    Author
    naloy:

    In the Jenkins configuration page:

    Error: Form.findMatchingInput is not a function
    Source File: http://jenkins.rightnow.com:8080/static/6dcd23a9/scripts/hudson-behavior.js
    Line: 338

  5. jenkins-infra-bot commented on Sep 26, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Sep 26, 2012
    Author
    windyroad:
    • Original comment link
    • Raw content of original comment: 
      I'm not as blocked as the reporting user, but I'm having the same problem (no valid crumb..). In my case it only seems to affect the console output, though the error can be seen for "ajaxBuildQueue" and "ajaxExecuters" on the config page, the home page (and I'm assuming others).
      


      What's interesting is that I only get this problem through a reverse proxy. http://ve.mbqblqmj.vesrv.com:8080/ works fine, but http://ci.windyroad.org/ (which is RPed to  http://ve.mbqblqmj.vesrv.com:8080/) does not.

    I'm not as blocked as the reporting user, but I'm having the same problem (no valid crumb..). In my case it only seems to affect the console output, though the error can be seen for "ajaxBuildQueue" and "ajaxExecuters" on the config page, the home page (and I'm assuming others).

    What's interesting is that I only get this problem through a reverse proxy. http://ve.mbqblqmj.vesrv.com:8080/ works fine, but http://ci.windyroad.org/ (which is RPed to http://ve.mbqblqmj.vesrv.com:8080/) does not.

  6. jenkins-infra-bot commented on Sep 26, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Sep 26, 2012
    Author
    windyroad:

    I've offered USD100.00 at FreedomSponsors to have this fixed (http://www.freedomsponsors.org/core/issue/31/no-valid-crumb-was-included-in-the-request-errors-all-around).
    Once you solve it (according to the acceptance criteria described there), just create a FreedomSponsors account and mark it as resolved (oh, you'll need a Paypal account too)
    I'll then check it out and will gladly pay.

  7. jenkins-infra-bot commented on Oct 25, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Oct 25, 2012
    Author
    onemanbucket:
    • Original comment link
    • Raw content of original comment: 
      I reproduced the problem with a simple nginx reverse proxy and csrf enabled.
      


      The problem is that jenkins stores its' csrf token in a http header called '.crumb', AFAIK headers must only contain alphanumerics and dashes, and nginx will remove invalid headers from the request (unless configured not to).
      


      Sooo, a workaround is to use ignore_invalid_headers in nginx or disable csrf protection until patched.
      


      I'll post a pull request shortly

    I reproduced the problem with a simple nginx reverse proxy and csrf enabled.

    The problem is that jenkins stores its' csrf token in a http header called '.crumb', AFAIK headers must only contain alphanumerics and dashes, and nginx will remove invalid headers from the request (unless configured not to).

    Sooo, a workaround is to use ignore_invalid_headers in nginx or disable csrf protection until patched.

    I'll post a pull request shortly

  8. jenkins-infra-bot commented on Oct 25, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Oct 25, 2012
    Author
    onemanbucket:
    • Original comment link
    • Raw content of original comment: 
      Actually, it seems that you can set the header name with a system property to jenkins (hudson.security.csrf.requestfield). So another workaround could be to start jenkins with -Dhudson.security.csrf.requestfield=crumb

    Actually, it seems that you can set the header name with a system property to jenkins (hudson.security.csrf.requestfield). So another workaround could be to start jenkins with -Dhudson.security.csrf.requestfield=crumb

  9. jenkins-infra-bot commented on Oct 25, 2012

    @jenkins-infra-bot
    jenkins-infra-bot
    on Oct 25, 2012
    Author
    onemanbucket:

    Pull request: #596

  10. jenkins-infra-bot commented on Feb 25, 2013

    @jenkins-infra-bot
    jenkins-infra-bot
    on Feb 25, 2013
    Author
    algob:
    • Original comment link
    • Raw content of original comment: 
      I've same issue, if I try to disable a project (use Jenkins v1.502):
   http://rhodan:8080/jenkins/job/myproject_3562/disable
      


      It looks like, I would have the same issue, if I would try to enable it, if it is disabled: JENKINS-14501
      


      I tried to added these line to /opt/tomcat/bin/catalina.sh, but it didn't solve the issue:
   — SNIP —
JAVA_OPTS="$JAVA_OPTS -Dhudson.security.csrf.requestfield=crumb"
   — SNAP —

    I've same issue, if I try to disable a project (use Jenkins v1.502):
    http://rhodan:8080/jenkins/job/myproject_3562/disable

    It looks like, I would have the same issue, if I would try to enable it, if it is disabled: JENKINS-14501

    I tried to added these line to /opt/tomcat/bin/catalina.sh, but it didn't solve the issue:
    — SNIP —
    JAVA_OPTS="$JAVA_OPTS -Dhudson.security.csrf.requestfield=crumb"
    — SNAP —

  11. jenkins-infra-bot commented on May 24, 2013

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 24, 2013
    Author
    ozawa:
    • Original comment link
    • Raw content of original comment: 
      Today, I've had also the same issue. Delete jobs or clone from github hasn't worked correctly.
This problem is caused after upgrading 1.515.

    Today, I've had also the same issue. Delete jobs or clone from github hasn't worked correctly.
    This problem is caused after upgrading 1.515.

  12. jenkins-infra-bot commented on Jun 6, 2013

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jun 6, 2013
    Author
    johnnygoods:
    • Original comment link
    • Raw content of original comment: 
      Also seeing this issue when using jenkins 1.517 behind nginx reverse proxy. Setting nginx ignore_invalid_headers had no effect. Disabling CSRF did.

    Also seeing this issue when using jenkins 1.517 behind nginx reverse proxy. Setting nginx ignore_invalid_headers had no effect. Disabling CSRF did.

  13. jenkins-infra-bot commented on Mar 12, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 12, 2014
    Author
    vadakr:
    • Original comment link
    • Raw content of original comment: 
      To disable CSRF (Screenshot) - 
      


      Jenkins > Manage Jenkins > Configure Global Security
      


      At the very bottom, you will see a checkbox for "Prevent Cross Site Request Forgery exploits". Uncheck this and apply.

    To disable CSRF (Screenshot) -

    Jenkins > Manage Jenkins > Configure Global Security

    At the very bottom, you will see a checkbox for "Prevent Cross Site Request Forgery exploits". Uncheck this and apply.

  14. jenkins-infra-bot commented on Apr 30, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 30, 2014
    Author
    daemoen:
    • Original comment link
    • Raw content of original comment: 
      Tested multiple scenarios.
      


      Following configs work:
OS: Centos 6 x86_64
Jenkins: 1.561 from Jenkins Repo
      


      NGINX Reverse Proxy Setup test #1 (works):
/etc/nginx/conf.d/jenkins.conf
      

      

      #
# Jenkins over SSL
#

upstream jenkins {
  server 127.0.0.1:8080 fail_timeout=0;
}

server {
  listen 80;
  server_name jenkins.domain.com;
  return 301 https://$host$request_uri;
}

server {
  ignore_invalid_headers off;
  listen 443;
  server_name jenkins.domain.com;

  ssl on;
  ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
  ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;

  location / {
    proxy_set_header        Host $host;
    proxy_set_header        X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;
    proxy_pass              http://jenkins;
  }
}

      

      

      NGINX Reverse Proxy Setup test #2 (does NOT work):
/etc/nginx/conf.d/jenkins.conf
      

      

      #
# Jenkins over SSL
#

      upstream jenkins {
      
server 127.0.0.1:8080 fail_timeout=0;
      
}
      

      server {
      
listen 80;
      
server_name jenkins.domain.com;
      
return 301 https://$host$request_uri;
      
      }
      

      server {
      
ignore_invalid_headers on; # Or simply leave it unspecified; This is the DEFAULT behavior of ignore_invalid_headers
      
listen 443;
      
server_name jenkins.domain.com;
      

      ssl on;
      
ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
      
ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;
      

      location / {
      
proxy_set_header        Host $host;
      
proxy_set_header        X-Real-IP $remote_addr;
      
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      
proxy_redirect http:// https://;
      
          proxy_pass              http://jenkins;
      
        }
      
}
      

      

      

      NGINX Reverse Proxy Setup test #3 (works):
/etc/nginx/conf.d/jenkins.conf
      

      

      #
# Jenkins over SSL
#

      upstream jenkins {
      
server 127.0.0.1:8080 fail_timeout=0;
      
}
      

      server {
      
listen 80;
      
server_name jenkins.domain.com;
      
return 301 https://$host$request_uri;
      
      }
      

      server {
      
ignore_invalid_headers on;
      
listen 443;
      
server_name jenkins.domain.com;
      

      ssl on;
      
ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
      
ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;
      

      location / {
      
proxy_set_header        Host $host;
      
proxy_set_header        X-Real-IP $remote_addr;
      
proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      
proxy_redirect http:// https://;
      
          proxy_pass              http://jenkins;
      
        }
      
}
      

      

      

      /etc/sysconfig/jenkins
      

      

      JENKINS_JAVA_OPTIONS="-Djava.awt.headless=true -Dhudson.security.csrf.requestfield=crumb"

    Tested multiple scenarios.

    Following configs work:
    OS: Centos 6 x86_64
    Jenkins: 1.561 from Jenkins Repo

    NGINX Reverse Proxy Setup test #1 (works):
    /etc/nginx/conf.d/jenkins.conf

    #
# Jenkins over SSL
#

upstream jenkins {
  server 127.0.0.1:8080 fail_timeout=0;
}

server {
  listen 80;
  server_name jenkins.domain.com;
  return 301 https://$host$request_uri;
}

server {
  ignore_invalid_headers off;
  listen 443;
  server_name jenkins.domain.com;

  ssl on;
  ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
  ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;

  location / {
    proxy_set_headerHost $host;
    proxy_set_headerX-Real-IP $remote_addr;
    proxy_set_headerX-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;
    proxy_pass      http://jenkins;
  }
}

    NGINX Reverse Proxy Setup test #2 (does NOT work):
    /etc/nginx/conf.d/jenkins.conf

    #
# Jenkins over SSL
#

upstream jenkins {
  server 127.0.0.1:8080 fail_timeout=0;
}

server {
  listen 80;
  server_name jenkins.domain.com;
  return 301 https://$host$request_uri;
}

server {
  ignore_invalid_headers on; # Or simply leave it unspecified; This is the DEFAULT behavior of ignore_invalid_headers
  listen 443;
  server_name jenkins.domain.com;

  ssl on;
  ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
  ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;

  location / {
    proxy_set_headerHost $host;
    proxy_set_headerX-Real-IP $remote_addr;
    proxy_set_headerX-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;
    proxy_pass      http://jenkins;
  }
}

    NGINX Reverse Proxy Setup test #3 (works):
    /etc/nginx/conf.d/jenkins.conf

    #
# Jenkins over SSL
#

upstream jenkins {
  server 127.0.0.1:8080 fail_timeout=0;
}

server {
  listen 80;
  server_name jenkins.domain.com;
  return 301 https://$host$request_uri;
}

server {
  ignore_invalid_headers on;
  listen 443;
  server_name jenkins.domain.com;

  ssl on;
  ssl_certificate /etc/nginx/ssl/wildcard.domain.chained.crt;
  ssl_certificate_key /etc/nginx/ssl/wildcard.domain.key;

  location / {
    proxy_set_headerHost $host;
    proxy_set_headerX-Real-IP $remote_addr;
    proxy_set_headerX-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_redirect http:// https://;
    proxy_pass      http://jenkins;
  }
}

    /etc/sysconfig/jenkins

    JENKINS_JAVA_OPTIONS="-Djava.awt.headless=true -Dhudson.security.csrf.requestfield=crumb"

  15. jenkins-infra-bot commented on May 1, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 1, 2014
    Author
    daemoen:
    • Original comment link
    • Raw content of original comment: 
      Further testing of this shows that even with the working setups above, chrome still does not like it.  Firefox works fine.

    Further testing of this shows that even with the working setups above, chrome still does not like it. Firefox works fine.

  16. 29 remaining items

  17. jenkins-infra-bot commented on Oct 17, 2016

    @jenkins-infra-bot
    jenkins-infra-bot
    on Oct 17, 2016
    Author
    danielbeck:

    12niner Too many cookies is tracked as JENKINS-25046.

  18. jenkins-infra-bot
    added
    bugFor changelog: Minor bug. Will be listed after features
    imported-jira-issue
    component:core
    resolution:fixed
    priority:critical
    on Nov 24, 2025

  19. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-24249]

  20. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-27972]

  21. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-25116]

  22. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-23793]

  23. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-7518]

  24. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-12787]

  25. jenkins-infra-bot
    added a parent issue on Nov 24, 2025
  26. jenkins-infra-bot
    added the
    Bug
    issue type on Nov 24, 2025
  27. jenkins-infra-bot
    removed
    bugFor changelog: Minor bug. Will be listed after features
    on Nov 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:coreimported-jira-issuepriority:criticalresolution:fixed

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions