CSRF protection in Jenkins - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable CSRF protection in Jenkins configuration.

Jenkins

jenkins.security.csrf[1] = true

Drag options to blanks, or click blank then click option'

A.enable

B.crumbIssuer

C.csrf

D.protection

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names like '.enable' or '.csrf'.

Setting jenkins.security.csrf.crumbIssuer enables CSRF protection in Jenkins by configuring the crumb issuer.

2fill in blank

medium

Complete the code to configure the CSRF crumb issuer class in Jenkins.

Jenkins

jenkins.security.csrf.crumbIssuerClass = '[1]'

Drag options to blanks, or click blank then click option'

ADefaultCrumbIssuer

BNoCrumbIssuer

CStrictCrumbIssuer

DSimpleCrumbIssuer

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing classes that do not exist or disable CSRF protection.

The DefaultCrumbIssuer class is the standard crumb issuer for CSRF protection in Jenkins.

3fill in blank

hard

Fix the error in the Jenkins pipeline script to correctly handle CSRF protection token.

Jenkins

def crumb = jenkins.model.Jenkins.instance.crumbIssuer.[1]()
httpRequest authentication: 'token', url: 'http://example.com/api', headers: [[name: 'Jenkins-Crumb', value: crumb]]

Drag options to blanks, or click blank then click option'

AgetCrumb

BretrieveCrumb

CgenerateCrumb

DfetchCrumb

Attempts:

3 left

💡 Hint

Common Mistakes

Using method names that do not exist in Jenkins API.

The method getCrumb() is used to get the CSRF crumb token from Jenkins.

4fill in blank

hard

Fill both blanks to configure Jenkins to disable CSRF protection and set crumb exclusion.

Jenkins

jenkins.security.csrf[1] = false
jenkins.security.csrf.crumbExclusion[2] = []

Drag options to blanks, or click blank then click option'

A.csrf

B.exclude

C.exclusions

D.crumb

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names that cause errors.

Setting jenkins.security.csrf.csrf to false disables CSRF protection.
Setting crumbExclusion.exclusions to an empty list clears crumb exclusions.

5fill in blank

hard

Fill all three blanks to create a Jenkins pipeline step that sends a POST request with CSRF token header.

Jenkins

def crumb = jenkins.model.Jenkins.instance.crumbIssuer.[1]()
httpRequest httpMode: '[2]', url: 'http://example.com/api', headers: [[name: '[3]', value: crumb]]

Drag options to blanks, or click blank then click option'

AgetCrumb

BPOST

CJenkins-Crumb

DfetchCrumb

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong method names or header names causing request failure.

The getCrumb() method fetches the CSRF token.
The HTTP method is POST for sending data.
The header name for CSRF token is Jenkins-Crumb.