Answers: <p>I believe this may be a result of running Jenkins behind a proxy, which can cause legitimate requests to perhaps appear to Jenkins as cross-site requests.  From the <a href="https://wiki.jenkins.io/display/JENKINS/CSRF+Protection" rel="nofollow noreferrer">official wiki</a>:</p>
  
  <blockquote>
    <p>If you are using nginx as a reverse proxy in front of Jenkins, you need an extra system property on Jenkins "-Dhudson.security.csrf.requestfield=Jenkins-Crumb". See JENKINS-23793 for more details</p>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2021-03-17T13:38:31.453Z
Answers: I wish I could re-upvote this. Bit me on a new jenkins install three years later and I found my own question in my googling. Thank you once again!
Answers: Alex
Answers: CC BY-SA 3.0
Answers: 2018-01-23T19:10:10.167Z
Answers: 2018-01-23T19:10:10.167Z
Answers: jayhendren
Body: <p>Recently Jenkins has been putting out a number of security warnings related to CSRF Protection. We tried enabling it on our version of Jenkins (ver. 2.89.2) only to find that with it enabled you can no longer add or edit parameters on either freestyle or pipeline jobs via the GUI. </p>
  
  <p>I did fairly extensive testing to narrow it down as the culprit, but I still don't understand why the option exists and is being recommended if it cripples Jenkins jobs. </p>
  
  <p>Is this a feature or a bug? If it is a feature, why? What's to gain?</p>
  
Tags: <jenkins>
Title: Enabling CSRF Protection prevents editing/adding parameters to jobs - intentional or bug?
UserDisplayName: Alex
ThreadText: # Enabling CSRF Protection prevents editing/adding parameters to jobs - intentional or bug?
  
  (Asked by: username_0 on 2018-01-22)
  
  Recently Jenkins has been putting out a number of security warnings related to CSRF Protection. We tried enabling it on our version of Jenkins (ver. 2.89.2) only to find that with it enabled you can no longer add or edit parameters on either freestyle or pipeline jobs via the GUI.
  
  I did fairly extensive testing to narrow it down as the culprit, but I still don't understand why the option exists and is being recommended if it cripples Jenkins jobs.
  
  Is this a feature or a bug? If it is a feature, why? What's to gain?
  
  **Tags:** jenkins
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-01-23. Score: 1 | Accepted answer
  
  I believe this may be a result of running Jenkins behind a proxy, which can cause legitimate requests to perhaps appear to Jenkins as cross-site requests. From the [official wiki](https://wiki.jenkins.io/display/JENKINS/CSRF+Protection):
  
  > If you are using nginx as a reverse proxy in front of Jenkins, you need an extra system property on Jenkins "-Dhudson.security.csrf.requestfield=Jenkins-Crumb". See JENKINS-23793 for more details
  
  > **Comments:**
  > **username_0**: I wish I could re-upvote this. Bit me on a new jenkins install three years later and I found my own question in my googling. Thank you once again!  
  
  ---
  
  