[JENKINS-76118] Toggle collapse links can trigger 404 errors when clicked before page scripts finish loading (Chrome-specific, regression in 2.500)

[jenkins-infra-bot]

When using the “collapse/expand” toggle links (e.g. Build Queue), clicking the button before the page has fully loaded can trigger a 404 error in Chrome. This is a regression introduced in Jenkins 2.500 by commit 84ef1a4d4db1, which changed the doToggleCollapse endpoint from GET to POST for security reasons.

Steps to reproduce

1. Open the Jenkins dashboard in Chrome under a slow network or with a heavy page load.

1. As soon as the toggle button (e.g. Build Queue) appears, click it immediately, before the page finishes loading.

1. The request sent is a GET to doToggleCollapse, resulting in a 404 Not Found.

1. If the same button is clicked after the page has fully loaded, the request is correctly sent as a POST and works.

1. In Firefox, this cannot be reproduced because the button is not made clickable until scripts are ready.

Technical details

• The toggle is rendered in Jelly as a plain anchor tag:
  
• By default, this issues a GET.

• Once lib/form/link/link.js is loaded, it attaches an onclick handler via Behaviour.specify("A.post"):

• • Creates a temporary

• • Sets method to POST

• • Adds the crumb

• • Submits the form, preventing the default click

• In Chrome, because of progressive rendering, the link becomes clickable before this handler is attached → early click = raw GET → 404.

Expected behavior

• The toggle button should never issue a GET.

• Clicking it at any time, regardless of page load state or browser, should result in a POST.

Possible solutions (ideas)

• Render the link as inactive until the JS handler is bound (e.g. remove href until ready, or mark disabled).

• Replace `@​POST` with `@​RequirePOST` which doesn't really solve the problem but makes it less broken.
• UI improvement rendering a loader of some sort until the component is fully loaded, to avoid displaying partially a component that isn't ready yet?

 

---

Thanks a lot for all your work!

---

Originally reported by aneveux, imported from: Toggle collapse links can trigger 404 errors when clicked before page scripts finish loading (Chrome-specific, regression in 2.500)

• assignee: minutehand
• status: Closed
• priority: Minor
• component(s): core
• resolution: Fixed
• resolved: 2025-11-05T05:32:17+00:00
• votes: 0
• watchers: 2
• imported: 2025-11-24

Raw content of original issue

When using the “collapse/expand” toggle links (e.g. Build Queue), clicking the button before the page has fully loaded can trigger a 404 error in Chrome. This is a regression introduced in Jenkins 2.500 by commit 84ef1a4d4db1, which changed the doToggleCollapse endpoint from GET to POST for security reasons.
Steps to reproduce

	
Open the Jenkins dashboard in Chrome under a slow network or with a heavy page load.




	
As soon as the toggle button (e.g. Build Queue) appears, click it immediately, before the page finishes loading.




	
The request sent is a GET to doToggleCollapse, resulting in a 404 Not Found.




	
If the same button is clicked after the page has fully loaded, the request is correctly sent as a POST and works.




	
In Firefox, this cannot be reproduced because the button is not made clickable until scripts are ready.



Technical details

	
The toggle is rendered in Jelly as a plain anchor tag:
<a class="collapse post" href="${rootURL}/toggleCollapse?paneId=executors">
	
By default, this issues a GET.




	
Once lib/form/link/link.js is loaded, it attaches an onclick handler via Behaviour.specify("A.post"):




	

	

		
Creates a temporary <form>
	
	




	

	

		
Sets method to POST
	
	




	

	

		
Adds the crumb
	
	




	

	

		
Submits the form, preventing the default click
	
	




	
In Chrome, because of progressive rendering, the link becomes clickable before this handler is attached → early click = raw GET → 404.



Expected behavior

	
The toggle button should never issue a GET.




	
Clicking it at any time, regardless of page load state or browser, should result in a POST.



Possible solutions (ideas)

	
Render the link as inactive until the JS handler is bound (e.g. remove href until ready, or mark disabled).




	
Replace `@POST` with `@RequirePOST` which doesn't really solve the problem but makes it less broken.
	
UI improvement rendering a loader of some sort until the component is fully loaded, to avoid displaying partially a component that isn't ready yet?



 

Thanks a lot for all your work!

• environment: Starting with Jenkins 2.500, in Google Chrome.

[jenkins-infra-bot]

minutehand:

• Original comment link
• Raw content of original comment:

  I'll try the fix going with the first idea. Removing href until ready.
  

I'll try the fix going with the first idea. Removing href until ready.