Bitbucket can not trigger a jenkins job when I used Bitbucket Push and Pull Request plugin

Question

I have a cloud bitbucket, and I configure the webhook like this as below: Then I installed "Bitbucket Push and Pull Request" plugin on my Jenkins, and configure the info as below: The plugin URL: https://plugins.jenkins.io/bitbucket-push-and-pull-request The global configure in jenkins: (Path: Manage Jenkins --> configure system) The configuration in jenkins job: (Credentials used username and app password with bitbucket) When I created a pull request on bitbucket, I saw the error in the webhook log: HTTP Status 403 – Forbidden

HTTP Status 403 – Forbidden

Type Status Report

Message No valid crumb was included in the request

Description The server understood the request but refuses to authorize it.

Apache Tomcat/9.0.74

Who can tell me where the configuration error caused this error?

Theodora Boudale · Answer

Hi Pratima,

You will also need to configure your proxy to include the crumb in a custom header in traffic it receives from Bitbucket Cloud before it forwards it to Jenkins. What the error means is that Jenkins does not receive this crumb.

Kind regards,
Theodora

Pratima Maiti · Answer

I have enabled Enable proxy compatibility as mentioned in that stackoverflow post along with same configuration mentioned by @Tingting_Zhou . But it's still giving the same issue.

Could you tell me what's wrong?

Theodora Boudale · Answer

Hi @Tingting_Zhou and welcome to the community!

Based on the error "No valid crumb was included in the request", it sounds like you most likely have enabled the option Prevent Cross Site Request Forgery exploits in Jenkins.

What is expected then is for Atlassian to include a header with the API upload
"Jenkins-Crumb: 0db38413bd7ec9e98974f5213f7ead8b", but we cannot include that with the webhook payload, so the request fails.

What you could do is use a proxy that will receive the traffic from Bitbucket and forward it to Jenkins, so that it includes the crumb in a custom header. You would need to enable the option Enable proxy compatibility in the CSRF Protection settings in Jenkins. You can check this StackOverflow post: https://stackoverflow.com/a/56167349

Another option would be to disable Prevent Cross Site Request Forgery exploits in Jenkins, but that would make you vulnerable to CSRF attacks.

Kind regards,
Theodora