Cross Site Request Forgery A cross site request forgery (or CSRF/XSRF) [24: www.owasp.org/index.php/Cross- Site_Request_Forgery] is an exploit that enables an unauthorized third party to perform requests against a web application by impersonating another, authenticated, user. In the context of a Jenkins environment, a CSRF attack could allow an malicious actor to delete projects, alter builds, or modify Jenkins' system configuration. To guard against this class of vulnerabilities, CSRF protection has been enabled by default with all Jenkins versions since 2.0. When the option is enabled, Jenkins will check for a CSRF token, or "crumb", on any request that may change data in the Jenkins environment. This includes any form submission and calls to the remote API, including those using "Basic" authentication. It is  strongly recommended  that this option be left  enabled , including on instances operating on private, fully trusted networks. Caveats CSRF protection  may  result in challenges for more advanced usages of Jenkins, such as: • Some Jenkins features, like the remote API, are more difficult to use when this option is enabled. Consult the Remote API documentation for more information. • Accessing Jenkins through a poorly-configured reverse proxy may result in the CSRF HTTP header being stripped from requests, resulting in protected actions failing. • Out-dated plugins, not tested with CSRF protection enabled, may not properly function. More information about CSRF exploits can be found on the OWASP website. 152