[JENKINS-6072] missing crumb header on project open

[jenkins-infra-bot]

After choosing a project, one AJAX POST request fails with 403 error. The request does not include the .crumb header.

Request: https://hudson/job/PROJECTNAME/buildHistory/ajax

Response:
<title>Error 403</title>

Status Code: 403

Exception: No valid crumb was included in the request
Stacktrace:

(none)

---

Generated by Winstone Servlet Engine v0.9.10 at Thu Mar 25 20:39:36 CET 2010

Hudson installation is in a local network.

---

Originally reported by jomey, imported from: missing crumb header on project open

• assignee: mindless
• status: Resolved
• priority: Major
• component(s): _unsorted
• resolution: Cannot Reproduce
• resolved: 2016-04-25T13:31:07+00:00
• votes: 2
• watchers: 4
• imported: 2025-12-08

Raw content of original issue

After choosing a project, one AJAX POST request fails with 403 error. The request does not include the .crumb header.

Request: https://hudson/job/PROJECTNAME/buildHistory/ajax

Response:
<html><head><title>Error 403</title></head><body bgcolor="#ffffff"><h1>Status Code: 403</h1>Exception: No valid crumb was included in the request<br>Stacktrace: <pre>(none)
</pre><br><hr size="1" width="90%"><i>Generated by Winstone Servlet Engine v0.9.10 at Thu Mar 25 20:39:36 CET 2010</i></body></html>

Hudson installation is in a local network.

environment

Mac OS X 10.6.2 Client,<br/>
Apache/2.2.13 (Unix) mod_ssl/2.2.13 OpenSSL/0.9.8l DAV/2 mod_jk/1.2.30,<br/>
Hudson build 1.352,<br/>
Hudson options: /usr/bin/java -Xms1G -Xmx1G -jar /PATH/TO/HUDSON/hudson.war --httpPort=-1 --ajp13Port=8090

1 attachment

• HUDSON-6072.diff

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  changing component, doesn't look related to changelog-history plugin.
  

changing component, doesn't look related to changelog-history plugin.

[jenkins-infra-bot]

dty:

• Original comment link
• Raw content of original comment:

  Added patch to this bug per mindless's request in
  
  http://n4.nabble.com/Ajax-update-of-build-history-broken-when-XSRF-crumbs-are-enabled-td1692971.html#a1692971
  
  As an addendum to my comments on the e-mail thread, the patch seems to fix the problem. I'm just not sure it's the best way to fix it.
  

Added patch to this bug per mindless's request in

http://n4.nabble.com/Ajax-update-of-build-history-broken-when-XSRF-crumbs-are-enabled-td1692971.html#a1692971

As an addendum to my comments on the e-mail thread, the patch seems to fix the problem. I'm just not sure it's the best way to fix it.

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  thx for the patch.. it did get me on the right track more quickly.
  prototype's Ajax.Request is supposed to support both arrays and objects for the requestHeaders, but it was Hudson's crumb handling that only supports objects (hence your workaround to change the input from array to object).  I'll add support for arrays in crumb.wrap.
  

thx for the patch.. it did get me on the right track more quickly.
prototype's Ajax.Request is supposed to support both arrays and objects for the requestHeaders, but it was Hudson's crumb handling that only supports objects (hence your workaround to change the input from array to object). I'll add support for arrays in crumb.wrap.

[jenkins-infra-bot]

scm_issue_link:

• Original comment link
• Raw content of original comment:

  Code changed in hudson
  User: : mindless
  Path:
   trunk/hudson/main/war/resources/scripts/hudson-behavior.js
   trunk/www/changelog.html
  http://jenkins-ci.org/commit/29597
  Log:
  [FIXED JENKINS-6072] Ajax.Request accepts both object(hash) or Array for requestHeaders,
  but crumb.wrap only worked with hash.. now support Array as well.
  This fixes ajax update of Build History when CSRF protection is turned on.
  

Code changed in hudson
User: : mindless
Path:
trunk/hudson/main/war/resources/scripts/hudson-behavior.js
trunk/www/changelog.html
http://jenkins-ci.org/commit/29597
Log:
[FIXED JENKINS-6072] Ajax.Request accepts both object(hash) or Array for requestHeaders,
but crumb.wrap only worked with hash.. now support Array as well.
This fixes ajax update of Build History when CSRF protection is turned on.

[jenkins-infra-bot]

rutsky:

• Original comment link
• Raw content of original comment:

  Is this fixes JENKINS-5241?
  

Is this fixes JENKINS-5241">JENKINS-5241?

[jenkins-infra-bot]

dbaktiar:

• Original comment link
• Raw content of original comment:

  This problem of "Missing Crumb Header on Project Open" also occurs when I am configuring project, and click on the "Preview" below the project "Description" field.
  I am running Jenkins 1.441 on Apache Tomcat 7.0.23, Windows 64-bit, Java 1.6.0_29.
  
  

This problem of "Missing Crumb Header on Project Open" also occurs when I am configuring project, and click on the "Preview" below the project "Description" field.
I am running Jenkins 1.441 on Apache Tomcat 7.0.23, Windows 64-bit, Java 1.6.0_29.

[jenkins-infra-bot]

danielbeck:

• Original comment link
• Raw content of original comment:

  Given the age of this issue, I'm resolving this.
  
  If something like this happens on recent Jenkins releases (notably 2.0), should be filed as a new issue.
  

Given the age of this issue, I'm resolving this.

If something like this happens on recent Jenkins releases (notably 2.0), should be filed as a new issue.

[jenkins-infra-bot]

[Original is_duplicated_by from Jira: JENKINS-5241]