Hi In our Jenkins System Log we see many instances of messages like these: Jun 08, 2021 12:09:17 PM WARNING hudson.security.csrf.CrumbFilter doFilter Found invalid crumb 3554fd3884df49f975319b4852c6caef3f8f0f96da8e2bfbcc493abf78cdc9d3. If you are calling this URL with a script, please use the API …

It’s normally a result of an expired session, nothing you can do about it. We probably shouldn’t log this by default, any thoughts @danielbeck @jglick ?

[image] timja: It’s normally a result of an expired session, nothing you can do about it. We’ve already adjusted logging here to not log when the associated session is anonymous. That’s the trivial “expired session” case. See [JENKINS-40344] Don't log warning for invalid crumb from anon by da…

We use multiple tabs so I guess that’s the cause. We don’t use automation. I think if a warning is issued, it is reasonable to expect to find a way to fix the problem. How can that be done in the case of multiple tabs?

I think if a warning is issued, it is reasonable to expect to find a way to fix the problem. How can that be done in the case of multiple tabs? Reload the page and you will get the new crumb If we stop logging this, we also no longer help users understand why their old scripts stopped working. …

[image] timja: API tokens have been around since ~2.89 isn’t it? How long do we ‘help’ them for? I’m not saying we shouldn’t change this, just pointing out there’s a downside. If we want some folks to have a cleaner system log while no longer helping others to understand why their scripts sta…

Hello, We start to configure the Jenkins Operator (latest version - Latest (v0.6.x):frowning: Latest (v0.8.x) | Jenkins Operator jenkins/jenkins:2.277.4-lts-alpine). In some cases we get in jenkins UI the following error message: HTTP ERROR 403 No valid crumb was included in the request The CSRF p…

Hi Irina, The original topic was about getting the error while doing api calls. That recommends you use api tokens so you don’t have the issue. For UI issues though, thats usually misconfiguration, proxy not passing headers right. Your jenkins url in your config doesn’t match the url your accessin…

Hello @Ira1 and @halkeye , Operator only runs a script to enable CSRF Protection with Default Crumb Issuer. You can configure Operator not to set this (setting Jenkins CR’s spec.master.disableCSRFProtection to true) if you’re fine with less secure connection. In general this problem doesn’t happe…

spec.master.disableCSRFProtection where do you set this ?

Are you using tomcat? @slide_o_mix found some stackoverflow posts about how to tweak tomcat support to fix the issue [image] Tomcat + Jenkins 2.346.3 CRUMB error on 1st startup Ask a question It’s possible that Tomcat is not sending along the remote IP. Can yo…

How to fix 'invalid crumb' warnings?

Using Jenkins

halkeye (Gavin Mogan) November 20, 2022, 6:01pm 11

Are you using tomcat? @slide_o_mix found some stackoverflow posts about how to tweak tomcat support to fix the issue

Topic		Replies	Views
Random '403 Invalid Crumb' messages through-out Jenkins Ask a question question	10	681	September 24, 2025
Upgrade from 2.204.6 to 2.289.3 failed on CSRF Using Jenkins	6	1617	August 10, 2022
No Valid Crumb Error After Plug-in Installation Using Jenkins	14	23051	May 12, 2025
Jenkins works during days and then no jobs can be run anymore on any agent Ask a question	8	1833	November 29, 2022
Jenkins Error Message:- No valid crumb was included in the request, Description:- The server understood the request but refuses to Authorize it Ask a question	1	1015	September 5, 2022

How to fix 'invalid crumb' warnings?

Related topics