20

I want to disable a Jenkins job by sending a post curl request to Jenkins.

I've tried doing that using:

  1. curl -X POST http://<server>:8080/<jobname>/disable
  2. curl -X POST http://<server>:8080/<jobname>/disable?token=<token>
  3. curl -u <username>:<token> POST http://<server>:8080/<jobname>/disable

but failed every time. The error i am getting is:

403 no valid crumb was included in the request

Is there a good curl based solution to this problem?

5 Answers 5

21

No valid crumb means your Jenkins installation has a security option enabled which prevent requests send in a standard way to avoid one-click attacks. You can't use Jenkins CLI either, because it doesn't work yet.

Here are the steps using curl (replace localhost with your Jenkins address):

  1. Note your user API Token (from /user/USER/configure).
  2. Get your crumb:

    CRUMB=$(curl -s 'http://USER:TOKEN@localhost:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
    
  3. Now you can disable the job by sending the crumb in the headers:

    curl -X POST -H "$CRUMB" http://USER:TOKEN@localhost:8080/<jobname>/disable
    

    If the above won't work for some reason, you may try to use -u USER:TOKEN instead.

1
  • 3
    Works great! Note that it might be cleaner to use curl -u user:pass http://localhost:8080/... instead of having the user/pass in the URL itself (depending on how you're scripting it). Dec 8, 2017 at 17:16
11

The crumb error indicates you are using CSRF Protection. You need to include a proper crumb header in your request. The crumb can be obtained from the Jenkins API as described on the Jenkins wiki page linked above. The answer for "Trigger parameterized build with curl and crumb" shows the syntax to adding the crumb header in the curl request.

2
  • is the crumb data always fixed or I have to get it using a query everytime?
    – rrawat
    Feb 20, 2015 at 0:19
  • @rwt The crumb is mostly static, but it does depend on the username and client IP. If you're writing a script where those parameters will vary, you're better off requesting the crumb at the start of the script. Feb 20, 2015 at 17:34
4

setup jenkins's "global security settings": Uncheck "Prevent Cross Site Request Forgery exploits"

1
3

I found the first part of kenorb's solution worked for me, i.e. getting the crumb, but for the second part, curl did not like that syntax, it said:

curl: (6) Couldn't resolve host 'http:'

So I had to use the following syntax which worked:

curl -H $CRUMB http://localhost:8080/<jobname>/disable -u USER:TOKEN

1
  • thank you, this is what i need in my java app, sending user:token in request header
    – To Kra
    Jan 19, 2017 at 14:41
1

The below is working for me

curl -X POST http://<servername>/job/jobname/disable

Make sure the user access to do that.

0

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.