No valid crumb was included in the request | Jenkins | Pheonixsolutions

Date Posted: 18-07-2018
Date Updated: 22-09-2026

Introduction

When working with Jenkins, you may encounter the following error while triggering jobs or making requests to the Jenkins server:

No valid crumb was included in the request

This error is related to Cross-Site Request Forgery (CSRF) protection in Jenkins. Jenkins uses a security crumb to validate requests and prevent unauthorized actions from being submitted to the server.

The issue can occur when a request is sent without a valid Jenkins crumb, when the crumb has expired, or when an integration or automation tool is not correctly handling Jenkins CSRF protection.

This article explains how to troubleshoot the error and configure Jenkins to accept the required requests.

Prerequisites

Before making changes, ensure that you have:

• Administrator access to Jenkins.
• Access to the Jenkins web interface.
• Permission to modify Jenkins security configuration.
• Basic knowledge of Jenkins administration.
• Access to the application or integration generating the request.

Implementation

Error Message

While working with Jenkins, you may see:

No valid crumb was included in the request

This generally means that Jenkins rejected the request because the request did not contain a valid CSRF crumb.

Reason

Jenkins uses CSRF protection to protect state-changing requests from unauthorized sources.

A request may be rejected when:

• The request does not contain a valid Jenkins crumb.
• The crumb is outdated or invalid.
• An external integration is not handling Jenkins CSRF protection correctly.
• A script or API client is making a POST request without obtaining the required crumb.

Solution 1: Disable CSRF Protection

Security warning: Disabling CSRF protection reduces the security of the Jenkins instance. It should generally not be the preferred solution, especially for an internet-facing production Jenkins server. If possible, configure the client or integration to obtain and send a valid Jenkins crumb instead.

If you are troubleshooting an older Jenkins deployment and need to temporarily disable CSRF protection, log in to Jenkins with administrator privileges.

Step 1: Open Jenkins Security Configuration

Navigate to:

Manage Jenkins
    ↓
Configure Global Security

Step 2: Locate CSRF Protection

Find the CSRF Protection section.

Depending on the Jenkins version, this may be displayed as:

Prevent Cross Site Request Forgery exploits

Step 3: Disable CSRF Protection

Uncheck the CSRF protection option.

Step 4: Save the Configuration

Click:

Save

Retry the operation that previously generated:

No valid crumb was included in the request

If the request succeeds after disabling CSRF protection, the issue is likely related to the client not providing a valid Jenkins crumb.

Solution 2: Use a Jenkins Crumb

A safer approach is to keep CSRF protection enabled and have the client obtain a valid crumb before making the request.

Jenkins provides a crumb issuer endpoint that can be used by clients to retrieve the required crumb.

For example:

curl -u USERNAME:API_TOKEN \
http://JENKINS_URL/crumbIssuer/api/json

The response contains information about the crumb and the HTTP header that should be supplied with subsequent requests.

The client can then include the returned crumb in the request.

This approach allows Jenkins to retain CSRF protection while supporting automated requests.

Solution 3: Check API Authentication

If the request is being generated by an external script, CI/CD integration, webhook, or automation tool, verify that it is using the appropriate Jenkins authentication method.

For API-based automation, an API token can be used with the Jenkins user account instead of the user’s password.

Example:

curl -u USERNAME:API_TOKEN \
http://JENKINS_URL/job/JOB_NAME/build

The exact authentication and crumb requirements can vary depending on the Jenkins version and request type.

Verification

After applying the appropriate configuration, retry the Jenkins operation that previously failed.

If CSRF protection remains enabled, verify that the client is:

1. Authenticating correctly.
2. Obtaining a valid Jenkins crumb when required.
3. Sending the crumb using the correct HTTP header.
4. Sending the request to the correct Jenkins URL.

Conclusion

The Jenkins error:

No valid crumb was included in the request

is commonly associated with Jenkins CSRF protection rejecting a request without a valid crumb.

For temporary troubleshooting, CSRF protection can be disabled through:

Manage Jenkins
→ Configure Global Security
→ CSRF Protection

However, disabling CSRF protection reduces Jenkins security. For production environments, it is preferable to keep CSRF protection enabled and configure the requesting application, script, or integration to obtain and provide a valid Jenkins crumb.

FAQ

1. What is a Jenkins crumb?

A Jenkins crumb is a security token used as part of Jenkins’ CSRF protection mechanism. It helps Jenkins verify that a state-changing request originated from an authorized context.

2. Why am I getting “No valid crumb was included in the request”?

The request reaching Jenkins does not contain a valid crumb when Jenkins expects one. This can happen with scripts, API clients, integrations, or improperly configured automation.

3. Can I disable CSRF protection?

Yes, administrators can disable CSRF protection from Jenkins’ global security configuration. However, this reduces security and should generally be avoided on production or internet-facing Jenkins installations.

Related Articles

• Integration of SonarQube in Jenkins
• Schedule Job in Jenkins

Talk to our experts

Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.