Jenkins uses js files, but how can i restrict from opening js files directly from browser

Community
1

Hi,

Want to know how can i restrict js files loaded by jenkins application should restrict from accessing directly from outside jenkins application.

Thanks & regards,
Nagaraj katta

2

Hello and welcome to this community, @NagarajK. :wave:

I’m not so sure I understand correctly your request, but to restrict JavaScript files loaded by the Jenkins application from being accessed directly from outside the Jenkins application, you can use Content Security Policy (CSP) headers.
CSP helps to control the resources that can be loaded and executed by the application.

Here are some steps to configure CSP in Jenkins:

  1. Make sure that the Content Security Policy (CSP) plugin is installed in your Jenkins controller. You can install it from the Jenkins plugin manager.
  2. Once the plugin is installed, you can configure the CSP headers to restrict access to JavaScript files. You can do this by adding the following configuration in the Jenkins system configuration:
    • Go to Manage Jenkins → Security.
    • Find the Content Security Policy section.
    • Add the CSP directives to restrict JavaScript file access. For example:
default-src 'self';
script-src 'self';

image
image2887×295 13.5 KB

This configuration should ensure that only scripts from the same origin (self) are allowed to be loaded and executed. :crossed_fingers:

  1. Save the configuration changes and restart Jenkins if necessary.
3

Thanks for the response.

As our CISO team doing application security and as part of this there are few .js files which are outdated(example yahoo-min.js) as they have requested to upgrade to latest version which i dont see anything to update.

So want to see these files are not allowed to open directly.
I will follow the above mentioned steps and see that sorts our requirement.

Thanks & Regards,
Nagaraj Katta

1 Like
4

In latest LTS (2.492.1) we have disabled the Yahoo UI libraries by default which would make the yahoo-min.js no longer being loaded by Jenkins itself. You would only need to reenable it if you use one of the few plugins that haven’t yet removed the usage of YUI.
It would not stop anyone from trying to load the yahoo libraries from Jenkins in their own website. But Jenkins provides these libraries via a variable url that changes each time you start Jenkins so trying to use it from there is not directly possible.

In Jenkins 2.493 and later YUI has been completely removed from Jenkins.

1 Like
5

In case the motivation is the CVEs published for Yahoo UI, they need to read the CVE descriptions. Jenkins is unaffected.