CloudBees CI Apache Tomcat 9.x 403 Error When Saving System Configuration: No valid crumb was included in the request

Last Reviewed:2025-06-16()
2 minute readKnowledge base

Issue

When attempting to save changes under Manage Jenkins > System, an HTTP Status 403 – Forbidden error is displayed in the browser, with the message:

No valid crumb was included in the request
▼

Environment

Observation

Several important indicators can be observed:

  1. In the Tomcat Catalina logs, you can see an INFO message indicating that the maximum number of request parameters was exceeded, immediately followed by 403 warnings:

    10-Jan-2025 19:22:44.420 INFO [Handling GET /cloudbees-core-cm/job/POC/job/bind/api/json from 10.132.40.34 : http-nio-18080-exec-22] org.apache.tomcat.util.http.Parameters.processParameters More than the maximum number of request parameters (GET plus POST) for a single request ([1,000]) were detected. Any parameters beyond this limit have been ignored. To change this limit, set the maxParameterCount attribute on the Connector.
Note: further occurrences of this error will be logged at DEBUG level.
    ▼
    10-Jan-2025 19:22:44.420 WARNING [Handling GET /cloudbees-core-cm/job/POC/job/bind/api/json from 10.132.40.34 : http-nio-18080-exec-22] hudson.security.csrf.CrumbFilter.doFilter No valid crumb was included in request for /cloudbees-core-cm/manage/configSubmit by <USER>. Returning 403.
10-Jan-2025 19:22:48.236 WARNING [Handling GET /cloudbees-core-cm/job/POC/job/bind/api/json from 10.132.40.34 : http-nio-18080-exec-22] hudson.security.csrf.CrumbFilter.doFilter No valid crumb was included in request for /cloudbees-core-cm/manage/configSubmit by <USER>. Returning 403.
    ▼

  2. From the Jenkins UI, the error message below appears after clicking Save in the system configuration:

Forbidden 403 UI Error

Root Cause

This issue is triggered by Tomcat rejecting requests that exceed its configured limit on the number of request parameters. When too many parameters are submitted (common in large configuration forms), the additional parameters resulting in a 403 Forbidden error.

The relevant setting is maxParameterCount from the official Apache Tomcat 9.x documentation:

maxParameterCount

The maximum total number of request parameters (including uploaded files) obtained from the query string and, for POST requests, the request body if the content type is application/x-www-form-urlencoded or multipart/form-data.

Request parameters beyond this limit will be ignored. A value of less than 0 means no limit. If not specified, a default of 10000 is used. Note that FailedRequestFilter filter can be used to reject requests that exceed the limit.

Resolution

To resolve this issue, you will need to increase the maxParameterCount setting value in your Tomcat configuration:

  1. Edit Tomcat’s server.xml file located at $CATALINA_BASE/conf/server.xml.

  2. Locate the <Connector> block for your HTTP connector (commonly port 8080).

  3. Increase the maxParameterCount value. For example:

    <Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           maxParameterCount="10000" />
    ▼

  4. Save the file and restart Tomcat to apply the change.

A value of 10000 is typically sufficient configured by default, but you can increase it further depending on the complexity and size of your configuration forms.

Additional Resources

Tested product/plugin versions