Repository navigation
[JENKINS-59514] Use @POST instead of @RequirePOST for form submission endpoints #20628
Description
Jenkins should not allow "attempt with POST" resubmissions of GET requests to form submission endpoints. They usually expects a form ( getSubmittedForm / structured form submission) with unexpected results when submission without a form is attempted (typically an exception stack trace, but who knows…)
Originally reported by 
danielbeck, imported from: Use @POST instead of @RequirePOST for form submission endpoints
- assignee: danielbeck
- status: Closed
- priority: Minor
- component(s): core
- label(s): 2.190.3-fixed, robustness
- resolution: Fixed
- resolved: 2019-10-07T08:10:29+00:00
- votes: 0
- watchers: 1
- imported: 2025-11-24
Raw content of original issue
Jenkins should not allow "attempt with POST" resubmissions of GET requests to form submission endpoints. They usually expects a form ( getSubmittedForm / structured form submission) with unexpected results when submission without a form is attempted (typically an exception stack trace, but who knows…)
Activity
jenkins-infra-bot commentedon Oct 7, 2019
Raw content of original comment:
As long as this does not block "form"al resubmission suggestions for GET URLs, like below, this is LGTM
````
This URL requires POST
The URL you're trying to access requires that requests be sent using POST (like a form submission).
The button below allows you to retry accessing this URL using POST. URL being accessed:
https://jenkins.domain/quietDown
If you were sent here from an untrusted source, please proceed with caution.
````
With a 2.198 weekly running, this seems to still work.
jenkins-infra-bot commentedon Oct 7, 2019
Raw content of original comment:
This change is only about endpoints that inherently cannot support this kind of use.
jenkins-infra-bot commentedon Oct 7, 2019
Raw content of original comment:
Specifically, any URL that server-side then calls StaplerRequest#getSubmittedForm.