No valid crumb in POST request

[magnlun]

Whenever I trigger a build from Stash I get the error:
WARNING: No valid crumb was included in request for XXX. Returning 403.
in Jenkins.

I have entered my username and password in the configuration so that shouldn't be the problem.

[tomasbjerre]

This is in a Jenkins log file right? What version of Jenkins do you use?
After some quick googling I guess maby you have "Prevent Cross Site Request Forgery exploits" enabled in Jenkins?
https://issues.jenkins-ci.org/browse/JENKINS-10263
And a bit more info on the CSRF Protection here:
https://wiki.jenkins-ci.org/display/JENKINS/Remote+access+API

This plugin should probably be extended with functionality for getting getting that crumb.

[magnlun]

Sorry about my unclearness :)

Jenkins version: 1.624
Yes we have the CSRF protection turned on

[tomasbjerre]

I saw you fork, are you planning on submitting a pull requst for this? It is important that the solution is not Jenkins-specific. This could be solved by adding a feature that can:

1. Invoke a URL
2. Read the response, or evaluate an XPath, or JsonPath... into a variable
3. Make that variable available for use in the other fields of the plugin

[magnlun]

Currently I'm just looking into the code to see if I could solve it. It doesn't look promising right now :)

[tomasbjerre]

Released in 1.22, open issue again if problem still exists!

[magnlun]

The feature seems to work fine, however I don't understand how to use it. Currently I'm always sending .crumb:, not just the crumb. Can you add a turtorial to the readme on how to use this feature properly? :)

[tomasbjerre]

If you browse to:
JENKINS_URL/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)
What do you get?
I never tried it on a real Jenkins instance, just unit-tests, so there may still be issues =)

[magnlun]

I get:
.crumb:a9fc665a713a53587bcec672d66ba935

The raw document (Without the concat) looks like this:

<defaultCrumbIssuer>
<crumb>a9fc665a713a53587bcec672d66ba935</crumb><crumbRequestField>.crumb</crumbRequestField>
</defaultCrumbIssuer>

And the json object looks like this:

{"crumb":"a9fc665a713a53587bcec672d66ba935","crumbRequestField":".crumb"}

So ideally there would be some way of easily getting the value of crumbRequestField=crumb

However if you call it with:
/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,"=",//crumb)
You get a security error

Now this was a long answer for a short question

[tomasbjerre]

Ok I see, I'll have a look later today. I think maby you should enter:
/crumbIssuer/api/xml?xpath=//crumb
And in headers add:
.crumb with value ${INJECTION_URL_VALUE}

[magnlun]

That returns:

<crumb>a9fc665a713a53587bcec672d66ba935</crumb>

So if I use that I get:
WARNING: Found invalid crumb <crumb>a47bb12c401423a90c7182a24c2654b0</crumb>. Will check remaining parameters for a valid one...

[tomasbjerre]

Perhaps adding /text() helps?
/crumbIssuer/api/xml?xpath=//crumb/text()

[magnlun]

I tried that, it returns a security error:
HTTP ERROR 403

Problem accessing /crumbIssuer/api/xml. Reason:

primitive XPath result sets forbidden; implement jenkins.security.SecureRequester

[tomasbjerre]

I may implement option to extract value from regexp into the ${INJECTION_URL_VALUE} variable.

You may be able to solve this with the current implementation, if you install this in Jenkins:
https://wiki.jenkins-ci.org/display/JENKINS/Secure+Requester+Whitelist+Plugin

[tomasbjerre]

Released regular expression feature in 1.27 and updated readme about it.