Jenkins: 403 No valid crumb was included in the request

Question

I configured jenkins in spinnaker as follows and setup spinnaker pipeline.

 jenkins:
    # If you are integrating Jenkins, set its location here using the bas         


        

Answer 1

For the new release of Jenkins you should follow the solution below:

https://jenkins.io/doc/upgrade-guide/2.176/#upgrading-to-jenkins-lts-2-176-3

Upgrading to Jenkins 2.176.2 Improved CSRF protection

SECURITY-626

CSRF tokens (crumbs) are now only valid for the web session they were created in to limit the impact of attackers obtaining them. Scripts that obtain a crumb using the /crumbIssuer/api URL will now fail to perform actions protected from CSRF unless the scripts retain the web session ID in subsequent requests. Scripts could instead use an API token, which has not required a CSRF token (crumb) since Jenkins 2.96.

To disable this improvement you can set the system property hudson.security.csrf.DefaultCrumbIssuer.EXCLUDE_SESSION_ID to true. Alternatively, you can install the Strict Crumb Issuer Plugin which provides more options to customize the crumb validation. It allows excluding the web session ID from the validation criteria, and instead e.g. replacing it with time-based expiration for similar (or even better) protection from CSRF

In my case helped installation of the Strict Crumb Issuer Plugin, rebooting jenkins and applying a less strict policy for the web interface of Jenkins as it is suggested on the vendor's site.