Navigation in Jenkins fails with 'No valid crumb was included in request' errors

Article ID:360039598171
2 minute readKnowledge base


  • Navigation within Jenkins often fails with: No valid crumb was included in request


Jenkins comes with a CSRF protection feature that is enabled by default. One of the security checks carried out by this feature is a strict IP check on the source of the incoming HTTP/S requests. It is based on the client IP of the request and the value of the X-FORWARDED_FOR header.

In some environments, this check would fail and causes No valid crumb was included in request. For example when a proxy is not preserving the client IP or the X-FORWARDED-FOR header is set but mis-configured

For more information, have a look at the DefaultCrumbIssuer


In most cases, the problem is related to the proxy configuration. Ensure that:

  • the proxy preserves the client IP

  • the X-FORWARDED-FOR header is properly set


A typical case is when Jenkins is running inside Kubernetes. If Jenkins is running in Kubernetes with an Ingress Controller that is backed by a NodePort / LoadBalancer service, make sure that this Service is configured with the externalTrafficPolicy: Local so that it preserves the client IP.


If changing the proxy configuration is not an option, a workaround is to disable the client IP check of the Crumb Issuer in Jenkins (labelled as "Proxy Compatibility" in the UI). Note that this is considered as unsafe since it disable a security check:

  • Go to Manage Jenkins  Configure Global Security  CSRF Protection

  • Tick the Enable proxy compatibility option:

jenkins csrf proxy compatibility
  • Save the configuration

This may also set on Jenkins startup via the system property -Djenkins.model.Jenkins.crumbIssuerProxyCompatibility=true

CloudBees Core on Modern Platform

For CloudBees Core on Modern Platforms installed with Helm, the proxy compatibility can be enabled with the the attribute .OperationsCenter.CSRF.ProxyCompatibility. For example:

    ProxyCompatibility: true