Skip to content

Redirects to jenkins.io after form submissions are being rejected in Chrome for violating CSP #26001

@daniel-beck

Description

@daniel-beck

Jenkins and plugins versions report

n/a

What Operating System are you using (both controller, and any agents involved in the problem)?

n/a

Reproduction steps

It's a somewhat common pattern in Jenkins to have the #doAct method in admin monitors redirect to documentation. Core occurrences:

return new HttpRedirect("https://www.jenkins.io/redirect/troubleshooting/broken-reverse-proxy");

rsp.sendRedirect("https://www.jenkins.io/redirect/csrf-protection/");

return new HttpRedirect("https://jenkins.io/redirect/java-support/");

This doesn't work in Chrome when CSP is enforcing form-action in Jenkins 2.539+. Per https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/form-action,

Warning: Whether form-action should block redirects after a form submission is debated and browser implementations of this aspect are inconsistent (e.g., Firefox 57 doesn't block the redirects whereas Chrome 63 does).

Expected Results

Redirect works.

Actual Results

It doesn't.

Anything else?

No response

Are you interested in contributing a fix?

No response

Metadata

Metadata

Assignees

Labels

csplts-candidateWhen fixed, this issue should be considered for backporting to the LTS line

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions