SECURITY-2470

jenkinsci · Aug 23, 2021 · 8b1e80e · 8b1e80e
1 parent f684139
commit 8b1e80e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/src/main/frontend/index.ts b/src/main/frontend/index.ts
@@ -10,5 +10,9 @@ document.addEventListener('DOMContentLoaded', (_) => {
         .replace('configureSecurity/', '')
         .replace('configure', '');
 
-    Providers.globalProvider = new ProxyProvider(`${endStrippedCurrentUrl}/GraphProxy`);
+    Providers.globalProvider = new ProxyProvider(`${endStrippedCurrentUrl}/GraphProxy`, async () => {
+        return {
+            [document.head.dataset.crumbHeader as string]: document.head.dataset.crumbValue,
+        };
+    });
 })
diff --git a/src/main/java/com/microsoft/jenkins/azuread/AzureSecurityRealm.java b/src/main/java/com/microsoft/jenkins/azuread/AzureSecurityRealm.java
@@ -701,7 +701,7 @@ public static final class CrumbExempt extends CrumbExclusion {
         public boolean process(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
                 throws IOException, ServletException {
             String pathInfo = request.getPathInfo();
-            if (pathInfo != null && (pathInfo.equals(CALLBACK_URL) || pathInfo.endsWith("GraphProxy/v1.0/$batch"))) {
+            if (pathInfo != null && pathInfo.equals(CALLBACK_URL)) {
                 chain.doFilter(request, response);
                 return true;
             }