{"id":2411,"date":"2018-07-18T12:43:53","date_gmt":"2018-07-18T07:13:53","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=2411"},"modified":"2026-09-22T10:10:14","modified_gmt":"2026-09-22T04:40:14","slug":"no-valid-crumb-was-included-in-the-request-jenkins-pheonixsolutions","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/no-valid-crumb-was-included-in-the-request-jenkins-pheonixsolutions\/","title":{"rendered":"No valid crumb was included in the request | Jenkins | Pheonixsolutions"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Date Posted: <\/strong>18-07-2018<br>Date Updated: 22-09-2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When working with Jenkins, you may encounter the following error while triggering jobs or making requests to the Jenkins server:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">No valid crumb was included in the request<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This error is related to <strong>Cross-Site Request Forgery (CSRF) protection<\/strong> in Jenkins. Jenkins uses a security crumb to validate requests and prevent unauthorized actions from being submitted to the server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue can occur when a request is sent without a valid Jenkins crumb, when the crumb has expired, or when an integration or automation tool is not correctly handling Jenkins CSRF protection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article explains how to troubleshoot the error and configure Jenkins to accept the required requests.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before making changes, ensure that you have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Administrator access to Jenkins.<\/li>\n\n\n\n<li>Access to the Jenkins web interface.<\/li>\n\n\n\n<li>Permission to modify Jenkins security configuration.<\/li>\n\n\n\n<li>Basic knowledge of Jenkins administration.<\/li>\n\n\n\n<li>Access to the application or integration generating the request.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Error Message<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">While working with Jenkins, you may see:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">No valid crumb was included in the request<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This generally means that Jenkins rejected the request because the request did not contain a valid CSRF crumb.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reason<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Jenkins uses <strong>CSRF protection<\/strong> to protect state-changing requests from unauthorized sources.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A request may be rejected when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The request does not contain a valid Jenkins crumb.<\/li>\n\n\n\n<li>The crumb is outdated or invalid.<\/li>\n\n\n\n<li>An external integration is not handling Jenkins CSRF protection correctly.<\/li>\n\n\n\n<li>A script or API client is making a POST request without obtaining the required crumb.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Solution 1: Disable CSRF Protection<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Security warning:<\/strong> Disabling CSRF protection reduces the security of the Jenkins instance. It should generally not be the preferred solution, especially for an internet-facing production Jenkins server. If possible, configure the client or integration to obtain and send a valid Jenkins crumb instead.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">If you are troubleshooting an older Jenkins deployment and need to temporarily disable CSRF protection, log in to Jenkins with administrator privileges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Open Jenkins Security Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate to:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Manage Jenkins\n    \u2193\nConfigure Global Security<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Locate CSRF Protection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Find the <strong>CSRF Protection<\/strong> section.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the Jenkins version, this may be displayed as:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Prevent Cross Site Request Forgery exploits<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Disable CSRF Protection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Uncheck the CSRF protection option.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Save the Configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Click:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Save<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Retry the operation that previously generated:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">No valid crumb was included in the request<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the request succeeds after disabling CSRF protection, the issue is likely related to the client not providing a valid Jenkins crumb.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solution 2: Use a Jenkins Crumb<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A safer approach is to keep CSRF protection enabled and have the client obtain a valid crumb before making the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Jenkins provides a crumb issuer endpoint that can be used by clients to retrieve the required crumb.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -u USERNAME:API_TOKEN \\\nhttp:\/\/JENKINS_URL\/crumbIssuer\/api\/json<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The response contains information about the crumb and the HTTP header that should be supplied with subsequent requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The client can then include the returned crumb in the request.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This approach allows Jenkins to retain CSRF protection while supporting automated requests.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solution 3: Check API Authentication<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the request is being generated by an external script, CI\/CD integration, webhook, or automation tool, verify that it is using the appropriate Jenkins authentication method.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For API-based automation, an API token can be used with the Jenkins user account instead of the user&#8217;s password.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -u USERNAME:API_TOKEN \\\nhttp:\/\/JENKINS_URL\/job\/JOB_NAME\/build<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact authentication and crumb requirements can vary depending on the Jenkins version and request type.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After applying the appropriate configuration, retry the Jenkins operation that previously failed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If CSRF protection remains enabled, verify that the client is:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Authenticating correctly.<\/li>\n\n\n\n<li>Obtaining a valid Jenkins crumb when required.<\/li>\n\n\n\n<li>Sending the crumb using the correct HTTP header.<\/li>\n\n\n\n<li>Sending the request to the correct Jenkins URL.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Jenkins error:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">No valid crumb was included in the request<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">is commonly associated with Jenkins CSRF protection rejecting a request without a valid crumb.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For temporary troubleshooting, CSRF protection can be disabled through:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Manage Jenkins\n\u2192 Configure Global Security\n\u2192 CSRF Protection<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">However, disabling CSRF protection reduces Jenkins security. For production environments, it is preferable to keep CSRF protection enabled and configure the requesting application, script, or integration to obtain and provide a valid Jenkins crumb.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">1. What is a Jenkins crumb?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A Jenkins crumb is a security token used as part of Jenkins&#8217; CSRF protection mechanism. It helps Jenkins verify that a state-changing request originated from an authorized context.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. Why am I getting &#8220;No valid crumb was included in the request&#8221;?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">The request reaching Jenkins does not contain a valid crumb when Jenkins expects one. This can happen with scripts, API clients, integrations, or improperly configured automation.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3. Can I disable CSRF protection?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, administrators can disable CSRF protection from Jenkins&#8217; global security configuration. However, this reduces security and should generally be avoided on production or internet-facing Jenkins installations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Related Articles<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/integration-of-sonarqube-in-jenkins\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Integration of SonarQube in Jenkins<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/schedule-job-in-jenkins\/?utm_source=chatgpt.com\" target=\"_blank\" rel=\"noreferrer noopener\">Schedule Job in Jenkins<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to our experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team <a target=\"_blank\" rel=\"noreferrer noopener\" href=\"https:\/\/pheonixsolutions.com\/contact?utm_source=chatgpt.com\">here<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Date Posted: 18-07-2018Date Updated: 22-09-2026 Introduction When working with Jenkins, you may encounter the following error while triggering jobs or [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1020],"tags":[],"class_list":["post-2411","post","type-post","status-publish","format-standard","hentry","category-containers-kubernetes","psol-cat-containers-kubernetes"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-CT","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2411"}],"version-history":[{"count":3,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2411\/revisions"}],"predecessor-version":[{"id":11876,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2411\/revisions\/11876"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}