python-jenkins-developers team mailing list archive

[Tom Wood <811044@xxxxxxxxxxxxxxxxxx>]

Hi James
I got an email after a post I made on the jenkins mailing list:
"
Do you have CSRF protection enabled? If you do, you need to request a crumb
from the server first, and include that as part of your POST request.

The instructions for how to do this need to be split out into its own page,
but you can find it in the "CSRF Protection" section here:

https://wiki.jenkins-ci.org/display/JENKINS/Monitoring+external+jobs
"

I did indeed have CSRF protection enabled which might explain why I was
seeing the problem and you weren't. (As it happens, this Jenkins
instance is only available on an internal company network, so CSRF
protection is probably a bit overkill).

I haven't got an explanation as to why things still work if you use a
GET request not POST - this would seem to be a hole in the CSRF
protection?!

Anyway this sort of explains what was going on.

Tom

-- 
You received this bug notification because you are a member of Python
Jenkins Developers, which is subscribed to Python Jenkins.
https://bugs.launchpad.net/bugs/811044

Title:
  With authorization, build job doesn't work using POST request

Status in Python API for Jenkins:
  Fix Released

Bug description:
  I've just stumbled into this project and am trying to use your latest
  version from source control along with Jenkins version 1.420 (the
  Ubuntu package version).

  Using authorization, I get a 403 response to the request in build_job:

          return
  self.jenkins_open(urllib2.Request(self.build_job_url(name, parameters,
  token), ''))

  If I remove the empty data string (which I understand means the
  request is GET rather than POST), everything works fine.

          return
  self.jenkins_open(urllib2.Request(self.build_job_url(name, parameters,
  token)))

  
  Not really sure if the cause for this is a bug in Jenkins or a problem with your script?

To manage notifications about this bug go to:
https://bugs.launchpad.net/python-jenkins/+bug/811044/+subscriptions