-
-
Notifications
You must be signed in to change notification settings - Fork 9.3k
Labels
csplts-candidateWhen fixed, this issue should be considered for backporting to the LTS lineWhen fixed, this issue should be considered for backporting to the LTS line
Description
Jenkins and plugins versions report
n/a
What Operating System are you using (both controller, and any agents involved in the problem)?
n/a
Reproduction steps
It's a somewhat common pattern in Jenkins to have the #doAct method in admin monitors redirect to documentation. Core occurrences:
| return new HttpRedirect("https://www.jenkins.io/redirect/troubleshooting/broken-reverse-proxy"); |
| rsp.sendRedirect("https://www.jenkins.io/redirect/csrf-protection/"); |
jenkins/core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java
Line 142 in 474f2aa
| return new HttpRedirect("https://jenkins.io/redirect/java-support/"); |
This doesn't work in Chrome when CSP is enforcing form-action in Jenkins 2.539+. Per https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/form-action,
Warning: Whether form-action should block redirects after a form submission is debated and browser implementations of this aspect are inconsistent (e.g., Firefox 57 doesn't block the redirects whereas Chrome 63 does).
Expected Results
Redirect works.
Actual Results
It doesn't.
Anything else?
No response
Are you interested in contributing a fix?
No response
Metadata
Metadata
Assignees
Labels
csplts-candidateWhen fixed, this issue should be considered for backporting to the LTS lineWhen fixed, this issue should be considered for backporting to the LTS line