Repository navigation
[JENKINS-3854] Crumb breaks ajax request behind proxies. #18853
Description
Hudson: 1.310-SNAPSHOT (svn trunk)
I checked "Prevent Cross Site Request Forgery exploits", then ajax request like
ajaxBuildQueue returned "HTTP/1.1 430 Forbidden".
I use Hudson installation behind some proxies.
In hudson.security.csrf.DefaultCrumbIssuer L58, "Request#getRemoteAddr()" is
used to update MessageDigest. but it will return diffrent IP behind proxies each
request.
Originally reported by 
sogabe, imported from: Crumb breaks ajax request behind proxies.
- assignee: dty
- status: Closed
- priority: Major
- component(s): core
- resolution: Fixed
- resolved: 2009-06-23T23:43:17+00:00
- votes: 0
- watchers: 0
- imported: 2025-11-24
Raw content of original issue
Hudson: 1.310-SNAPSHOT (svn trunk)
I checked "Prevent Cross Site Request Forgery exploits", then ajax request like ajaxBuildQueue returned "HTTP/1.1 430 Forbidden".
I use Hudson installation behind some proxies.
In hudson.security.csrf.DefaultCrumbIssuer L58, "Request#getRemoteAddr()" is used to update MessageDigest. but it will return diffrent IP behind proxies each request.
- environment:
Platform: All, OS: All
Activity
jenkins-infra-bot commentedon Jun 9, 2009
Raw content of original comment:
s/"HTTP/1.1 430 Forbidden/"HTTP/1.1 403 Forbidden/
jenkins-infra-bot commentedon Jun 16, 2009
Raw content of original comment:
Forwarding it to Dean.
jenkins-infra-bot commentedon Jun 16, 2009
dty:
Raw content of original comment:
I'll add some additional code to the default crumb issuer to check some standard HTTP headers that
usually get filled in with the real client IP address. This is not a 100% guaranteed solution. If I have time,
I'll also create a new crumb issuer that uses different information to calculate the crumb that should be
stable behind a proxy.
I'll shoot to have this completed for 1.312
jenkins-infra-bot commentedon Jun 23, 2009
dty:
Raw content of original comment:
Got the commit message format wrong to post the diffs here.
http://fisheye4.atlassian.com/changelog/hudson/trunk/hudson/main?cs=19132
Looks like Kohsuke released 1.312 from the 3.11 RC branch, so this will be in 1.313.
jenkins-infra-bot commentedon Nov 24, 2025
[Original
relates_tofrom Jira: JENKINS-7518]