Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50767

Control initial crumb issuer proxy compatibility value

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Resolved (View Workflow)
    • Priority: Minor
    • Resolution: Fixed
    • Component/s: core
    • Labels:
      None
    • Similar Issues:

      Description

      The Jenkins Setup Wizard enables the CSRF protection.
      By default, this takes into account the client IP.

      In some setups involving reverse proxies, the client IP seen by Jenkins is not the real client IP, but the IP of the reverse proxy. Sometimes, it is due to incorrect reverse proxy configuration, but in some other cases, it is a limitation that cannot be overcome.

      Examples:

      • Azure Load Balancer is a Layer 4 load balancer (TCP). The IP Jenkins sees is the internal IP of the load balancer. Since it is pooled, this IP can change from request to request and cause crumb error.
      • AWS ELB using TCP listener (Layer 4): same problem.

      Note: on AWS, it is possible to use a HTTP listener and it will set the http header X-Forwarded-For containing the real client IP and Jenkins doesn't need proxy compatibility. For https deployment you have to terminate the SSL connection at the ELB level, which is not the case when using the Layer 4 Load balancer.

      This default setttings can then cause problems (invalid crumb errors) when using the default setup.

      The goal of this issue is to provide a way to enable or disable the initial state on startup using a system property.

      e.g. -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true will enable Proxy Compatibility on first startup.

        Attachments

          Issue Links

            Activity

            Hide
            danielbeck Daniel Beck added a comment -

            To clarify, Azure does not offer a load balancer that does not have this problem?

            Show
            danielbeck Daniel Beck added a comment - To clarify, Azure does not offer a load balancer that does not have this problem?
            Hide
            vlatombe Vincent Latombe added a comment -

            Indeed.

            Show
            vlatombe Vincent Latombe added a comment - Indeed.
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Vincent Latombe
            Path:
            core/src/main/java/jenkins/install/SetupWizard.java
            http://jenkins-ci.org/commit/jenkins/909f55b77da1d4a0a16a818fe592504538e49430
            Log:
            JENKINS-50767 Control crumb issuer proxy compatibility through system property (#3389)

            -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true enables proxy compatibility on startup

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Vincent Latombe Path: core/src/main/java/jenkins/install/SetupWizard.java http://jenkins-ci.org/commit/jenkins/909f55b77da1d4a0a16a818fe592504538e49430 Log: JENKINS-50767 Control crumb issuer proxy compatibility through system property (#3389) -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true enables proxy compatibility on startup

              People

              • Assignee:
                vlatombe Vincent Latombe
                Reporter:
                vlatombe Vincent Latombe
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: