[JIRA] (JENKINS-57895) Enable/Disable Job via REST redirects after succeeding causing 403

10 views
Skip to first unread message

jvanderzouwen@compliancesystems.com (JIRA)

unread,
Jun 6, 2019, 2:54:02 PM6/6/19
to jenkinsc...@googlegroups.com
James VanderZouwen created an issue
 
Jenkins / Bug JENKINS-57895
Enable/Disable Job via REST redirects after succeeding causing 403
Issue Type: Bug Bug
Assignee: Unassigned
Components: core
Created: 2019-06-06 18:53
Environment: Jenkins 2.173
Labels: jenkins
Priority: Minor Minor
Reporter: James VanderZouwen

Using powershell, you can easily reproduce this.
assumptions: anonymous access is completely disabled

$theCredentials = "user:****USERTOKEN****";
$basicAuth = "Basic " + [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($theCredentials))
$headers = @

{ "Authorization" = $basicAuth }

Invoke-WebRequest -Method "Post" -Uri "http://jenkinsstaging.mycompany.com:8000/job/COMPILE_CHANGE-2297/enable" -Headers $headers

This works, but then the call is redirected to the issue page without the auth headers - causing a 403 unauthorized.  This should respond with a 200

 
Add Comment Add Comment
 
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

jvanderzouwen@compliancesystems.com (JIRA)

unread,
Jun 6, 2019, 2:55:02 PM6/6/19
to jenkinsc...@googlegroups.com
James VanderZouwen commented on Bug JENKINS-57895
 
Re: Enable/Disable Job via REST redirects after succeeding causing 403

I should mention that we do not enforce CSRF tokens

dbeck@cloudbees.com (JIRA)

unread,
Jun 13, 2019, 2:33:03 PM6/13/19
to jenkinsc...@googlegroups.com
Daniel Beck closed an issue as Not A Defect
 

This is a client-side problem.
Change By: Daniel Beck
Status: Open Closed
Resolution: Not A Defect

jvanderzouwen@compliancesystems.com (JIRA)

unread,
Jun 24, 2019, 10:28:03 AM6/24/19
to jenkinsc...@googlegroups.com

dbeck@cloudbees.com (JIRA)

unread,
Jun 24, 2019, 10:36:02 AM6/24/19
to jenkinsc...@googlegroups.com

The client needs to be instructed to send auth headers with every request. You're already jumping through hoops because Powershell apparently cannot send regular auth without a 401 challenge.

jvanderzouwen@compliancesystems.com (JIRA)

unread,
Jun 24, 2019, 11:23:02 AM6/24/19
to jenkinsc...@googlegroups.com

ok - thanks.  FYI - I was able to get past the redirect using the workaround here: https://stackoverflow.com/questions/52637039/invoke-webrequest-gets-401-on-post-but-not-on-get-with-basic-auth 
Reply all
Reply to author
Forward
0 new messages