Jenkins CSRF protection stops another website from tricking a logged in user's browser into changing Jenkins. Every request that modifies data must carry a crumb, a token tied to that user and session. Leave it on. The Jenkins documentation strongly recommends this even on private networks.
What CSRF is
Cross site request forgery means a page you visit makes your browser send a request to a service where you are already logged in. Without a check, Jenkins would treat a forged "trigger build" or "change configuration" request as yours.
How the crumb works
The Default Crumb Issuer builds the crumb hash from three values: the username, the web session ID and a salt unique to that Jenkins instance. All three must match when the crumb comes back. A crumb issued to one user is rejected for another. You configure it under Manage Jenkins, then Security, then CSRF Protection. Plugins can supply other issuers, and the Strict Crumb Issuer plugin is one with more options.
Reverse proxies
Before Jenkins 2.543, the client IP address could be part of the crumb, and an "Enable proxy compatibility" option removed it for setups where the apparent IP changed. Version 2.543 removed that option because the session ID gives stronger protection. If you still see proxy related crumb errors on an old controller, upgrading may fix the cause.
Scripts and automation
| Client method | What it needs |
|---|---|
| Username and password | Request a crumb from /crumbIssuer/api, keep the session cookie, then send username, password, crumb and cookie on each call |
| Username and API token | No crumb needed, since token requests are exempt from CSRF checks |
An API token is the simpler choice for scripts, and it avoids putting a password in a pipeline.
If a plugin breaks with CSRF on
Outdated plugins may fail with protection enabled. The docs describe a temporary startup property that disables it, and they advise against leaving it that way. The better fix is to update or replace the plugin. If you must use the property, set a date to remove it and note why.
Checklist
- Confirm CSRF Protection is enabled under Security.
- Move scripts from passwords to API tokens.
- Update plugins that break, rather than disabling protection.
- Upgrade past 2.543 if proxy options are causing trouble.
- Review any startup flags that disable security features.
Try it yourself
This demo scans an API for security issues, the same family of checks that catches missing request protections.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard includes policies and gates that can enforce settings checks in a pipeline, and a free scan to get started.
Quick check
Does an API token need a crumb?
No. The Jenkins CSRF page says requests using a username and API token are exempt from CSRF checks.
Is it safe to disable CSRF protection on an internal network?
The documentation strongly recommends leaving it enabled even on private, trusted networks.
Sources
Last reviewed: 19 October 2026.
