[JENKINS-47372] Create Admin Monitor for disabled CSRF protection

[jenkins-infra-bot]

Currently there is no admin monitor for CSRF protection. It is rather bug than feature.

Acceptance criteria:

• If CSRF is disabled on the instance, an admin gets administrative warning
• There is a functional test, which checks the case

 

 

---

Originally reported by oleg_nenashev, imported from: Create Admin Monitor for disabled CSRF protection

• assignee: wfollonier
• status: Closed
• priority: Minor
• component(s): core
• label(s): CSRF, administrative-monitor, csrf, security
• resolution: Fixed
• resolved: 2017-10-19T13:44:08+00:00
• votes: 0
• watchers: 3
• imported: 2025-11-24

Raw content of original issue

Currently there is no admin monitor for CSRF protection. It is rather bug than feature.

Acceptance criteria:

	
If CSRF is disabled on the instance, an admin gets administrative warning
	
There is a functional test, which checks the case



 

 

[jenkins-infra-bot]

scm_issue_link:

• Original comment link
• Raw content of original comment:

  Code changed in jenkins
  User: Oleg Nenashev
  Path:
   content/redirect/csrf-protection.adoc
  http://jenkins-ci.org/commit/jenkins.io/05e78b648dd213ecb31c532ae6bdef1e885191d3
  Log:
    JENKINS-47372 - Add CSRF Protection Page redirect
  
  
  

Code changed in jenkins
User: Oleg Nenashev
Path:
content/redirect/csrf-protection.adoc
http://jenkins-ci.org/commit/jenkins.io/05e78b648dd213ecb31c532ae6bdef1e885191d3
Log:
JENKINS-47372 - Add CSRF Protection Page redirect

[jenkins-infra-bot]

scm_issue_link:

• Original comment link
• Raw content of original comment:

  Code changed in jenkins
  User: Wadeck Follonier
  Path:
   core/src/main/java/jenkins/security/csrf/CSRFAdministrativeMonitor.java
   core/src/main/resources/jenkins/security/csrf/CSRFAdministrativeMonitor/message.jelly
   core/src/main/resources/jenkins/security/csrf/CSRFAdministrativeMonitor/message.properties
   core/src/main/resources/jenkins/security/csrf/Messages.properties
   test/src/test/java/jenkins/security/csrf/CSRFAdministrativeMonitorTest.java
  http://jenkins-ci.org/commit/jenkins/02b8e7f3563ac5c758e5829949533ff47bc81e65
  Log:
    JENKINS-47372 Add a new Administrative monitor for CSRF-protection (#3072)
  
  
  	
  JENKINS-47372 add administrative monitor when there is no CSRF issuer configured
  
  
  
  
  	
  - add line breaks
  
  
  
  
  	
  - add license header
  
  
  	
  put link in the properties instead of the previous mix
  	
  remove @author
  	
  simplify isActivated body
  
  
  
  
  	
  - correct line breaks
  
  
  
  
  

Code changed in jenkins
User: Wadeck Follonier
Path:
core/src/main/java/jenkins/security/csrf/CSRFAdministrativeMonitor.java
core/src/main/resources/jenkins/security/csrf/CSRFAdministrativeMonitor/message.jelly
core/src/main/resources/jenkins/security/csrf/CSRFAdministrativeMonitor/message.properties
core/src/main/resources/jenkins/security/csrf/Messages.properties
test/src/test/java/jenkins/security/csrf/CSRFAdministrativeMonitorTest.java
http://jenkins-ci.org/commit/jenkins/02b8e7f3563ac5c758e5829949533ff47bc81e65
Log:
JENKINS-47372 Add a new Administrative monitor for CSRF-protection (#3072)

• JENKINS-47372 add administrative monitor when there is no CSRF issuer configured

• - add line breaks

• - add license header

• put link in the properties instead of the previous mix
• remove @​author
• simplify isActivated body

• - correct line breaks

[jenkins-infra-bot]

recampbell:

• Original comment link
• Raw content of original comment:

  Merged towards jenkins-2.85
  

Merged towards jenkins-2.85