| It's impossible because it's impossible  . However, meanwhile, I understood the aim is to have (some) api endpoints that can be accessed by jenkins-agnostic third party tools. Now, I wonder if this "exclude crumb" method is a good way of doing this. The CSRF problem is, that authenticated users (meaning persons using a web browser) can be made do http calls because their credentials are always sent with each browser request. If you implement crumb exclusions, these API endpoints are again vulnerable to CSRF attacks.
If you have, for example, an endpoint that should accessed with a security token as authentication mechanism, it can now be called via CSRF with the user authentication. I think the correct way to implement this would rather be to require CSRF token for all user/password based authenticated requests, while not requiring the CSRF token for all requests that contain a valid token (or user/token combination in case of user api tokens). That way, you don't need any exclusions while all endpoints should still be perfectly safe from CSRF attacks. Please correct me, if I'm wrong. |
