CSRF protection in Jenkins - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CSRF stand for in Jenkins security?

CSRF stands for Cross-Site Request Forgery. It is a type of attack where unauthorized commands are transmitted from a user that the web application trusts.

beginner

How does Jenkins protect against CSRF attacks by default?

Jenkins uses a CSRF protection mechanism called a 'crumb'. It generates a unique token (crumb) for each user session that must be included in POST requests to verify the request is legitimate.

intermediate

What is a Jenkins crumb in the context of CSRF protection?

A Jenkins crumb is a unique token generated per user session. It must be sent with POST requests to Jenkins to prove the request is from a trusted source and not a CSRF attack.

intermediate

How can you disable CSRF protection in Jenkins, and why is it not recommended?

You can disable CSRF protection in Jenkins by unchecking 'Prevent Cross Site Request Forgery exploits' in the Configure Global Security settings. It is not recommended because it exposes Jenkins to CSRF attacks, risking unauthorized actions.

advanced

How do Jenkins API clients handle CSRF protection when making POST requests?

Jenkins API clients must first request a crumb from the Jenkins server and include it in the header of POST requests. This crumb proves the request is legitimate and prevents CSRF attacks.

What is the purpose of the Jenkins crumb in CSRF protection?

A To verify that POST requests come from a trusted user session

B To encrypt Jenkins passwords

C To speed up Jenkins builds

D To store Jenkins job configurations

The Jenkins crumb is a token used to verify that POST requests are from a trusted user session, preventing CSRF attacks.

Where do you configure CSRF protection settings in Jenkins?

A Manage Jenkins > Credentials

B Manage Jenkins > System Information

C Manage Jenkins > Plugin Manager

D Manage Jenkins > Configure Global Security

CSRF protection settings are found under Manage Jenkins > Configure Global Security.

What happens if you disable CSRF protection in Jenkins?

A Jenkins automatically updates plugins

B Jenkins becomes vulnerable to unauthorized commands from attackers

C Jenkins disables all POST requests

D Jenkins runs faster

Disabling CSRF protection makes Jenkins vulnerable to attacks where unauthorized commands can be sent by attackers.

How do Jenkins API clients obtain the crumb token?

A By reading the Jenkins log files

B By logging into Jenkins UI

C By sending a GET request to /crumbIssuer/api/json

D By installing a Jenkins plugin

API clients get the crumb token by sending a GET request to /crumbIssuer/api/json endpoint.

Which HTTP method requires the Jenkins crumb token to prevent CSRF?

A POST

B GET

C HEAD

D OPTIONS

POST requests require the crumb token to verify the request is legitimate and prevent CSRF attacks.

Explain what CSRF protection is in Jenkins and how the crumb mechanism works.

Think about how Jenkins ensures requests come from trusted users.

Describe the risks of disabling CSRF protection in Jenkins and when you might need to configure it.

Consider what happens if attackers can send unauthorized commands.