search

jenkinsci / bitbucket-push-and-pull-request-plugin

Plugin for Jenkins v2.138.2 or later, that triggers job builds on Bitbucket's push and pull request events.
https://plugins.jenkins.io/bitbucket-push-and-pull-request
MIT License
47 stars 49 forks source link

HTTP ERROR 403 No valid crumb was included in the request #186

Closed Chupaka closed 2 years ago

Chupaka commented 3 years ago

Hello.

We migrated some projects from GitLab to BitBucket and are trying to use this plugin to trigger jobs from BB.

On Jenkins 2.249.3, I see "HTTP ERROR 403 No valid crumb was included in the request" error when BitBucket server tries to POST to http://jenkins.address.com:8080/bitbucket-hook/ URL.

Here's the request:

POST /bitbucket-hook/ HTTP/1.1
X-Event-Key: diagnostics:ping
Accept: */*
X-Request-Id: fd5cff1b-cfa4-4e49-99ff-cf83e411ba90
Content-Type: application/json
Via: 1.1 localhost (Apache-HttpClient/4.5.5 (cache))
Content-Length: 14
Host: jenkins.address.com:8080
Connection: Keep-Alive
User-Agent: Atlassian HttpClient 2.1.0 / Bitbucket-7.3.1 (7003001) / Default

{"test": true}

And the response:

HTTP/1.1 403 Forbidden
X-Content-Type-Options: nosniff
Cache-Control: must-revalidate,no-cache,no-store
Content-Type: text/html;charset=iso-8859-1
Content-Length: 557
Server: Jetty(9.4.30.v20200611)

<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 403 No valid crumb was included in the request</title>
</head>
<body><h2>HTTP ERROR 403 No valid crumb was included in the request</h2>
<table>
<tr><th>URI:</th><td>/bitbucket-hook/</td></tr>
<tr><th>STATUS:</th><td>403</td></tr>
<tr><th>MESSAGE:</th><td>No valid crumb was included in the request</td></tr>
<tr><th>SERVLET:</th><td>Stapler</td></tr>
</table>
<hr><a href="http://eclipse.org/jetty">Powered by Jetty:// 9.4.30.v20200611</a><hr/>

</body>
</html>

We don't have this problem for HTTP endpoint of Generic Webhook Trigger Plugin, but it has some "features" so we're looking for something more BitBucket-native...

ltensok commented 3 years ago

Encountered the exact same error when trying out this plugin on Jenkins 2.249.2. Currently we are using Bitbucket plugin which is able to receive webhooks but lacks functionality so we are looking for an alternative.

Chupaka commented 3 years ago

@ltensok looks like the problem with "No valid crumb" is gone after upgrading Jenkins to 2.277.4. Can you check that?

cdelmonte-zg commented 3 years ago

Hi! Is the issue still actual? Tnx

Szbuli commented 3 years ago

It may be a misleading error, as if you set an incorrect webhook endpoint the plugin will set a different one for CrumbExclusion.

I think the main problem is that the documentation has in incorrect example to override the default webhook endpoint. The documentation says you can set "/bitbucket-ppr-webhook/" but checking the code its clear thats it is not correct. The working value is "bitbucket-ppr-webhook".

ltensok commented 3 years ago

@ltensok looks like the problem with "No valid crumb" is gone after upgrading Jenkins to 2.277.4. Can you check that?

@Chupaka Haven't yet been able to test this - have to find a suitable time window to update & restart Jenkins.

ltensok commented 3 years ago

It may be a misleading error, as if you set an incorrect webhook endpoint the plugin will set a different one for CrumbExclusion.

I think the main problem is that the documentation has in incorrect example to override the default webhook endpoint. The documentation says you can set "/bitbucket-ppr-webhook/" but checking the code its clear thats it is not correct. The working value is "bitbucket-ppr-webhook".

@Szbuli Tried with and without slashes with identical results - no valid crumb (maybe Jenkins restart is required to apply the webhook url change - cannot test this atm).

cdelmonte-zg commented 3 years ago

We are actually using the Jenkins version 2.277.4. and all is working fine. You can check the code for the crumb exclusion here:

https://github.com/jenkinsci/bitbucket-push-and-pull-request-plugin/blob/master/src/main/java/io/jenkins/plugins/bitbucketpushandpullrequest/BitBucketPPRCrumbExclusion.java

@Szbuli tnx for the hint, I fixed the documentation eliminating the slashes. And yes, as you wrote, the correct value is "bitbucket-ppr-webhook", without slashes.

@ltensok yes, jenkins needs to be restarted.

Please let me know if the problem still exists, tnx

pszittyay commented 3 years ago

I am getting the same error using Jenkins 2.289.3 and Plugin 2.7.2. This is the only Bitbucket PlugIn installed. I have enabled the Log on this plugin but no logs is generated. I also try using an Access Token but i get a 404 Not Found using the http://user:token@jenkinsurl.com/bitbucket-hook/. I tested this configuration for other URLs and it is ok (using incognito mode, i successfully get logged in) I have restarted the Jenkins serveral times just to be sure.

Error 403 No valid crumb was included in the request
HTTP ERROR 403 No valid crumb was included in the request
URI:/bitbucket-hook/
STATUS:403
MESSAGE:No valid crumb was included in the request
pszittyay commented 3 years ago

I have managed to make it run by disabling CSRF protection. At the end of this page https://www.jenkins.io/doc/book/security/csrf-protection/

To disable CSRF protection, set the system property hudson.security.csrf.GlobalCrumbIssuerConfiguration.DISABLE_CSRF_PROTECTION to true on startup.

cdelmonte-zg commented 2 years ago

Hallo @Chupaka and @pszittyay I couldn't reproduce this behavior. Please reopen the ticket if the issue still exists, Tnx