SECURITY-2470

Author: timja

src/main/frontend/index.ts

@@ -10,5 +10,9 @@ document.addEventListener('DOMContentLoaded', (_) => {
         .replace('configureSecurity/', '')
         .replace('configure', '');
 
-    Providers.globalProvider = new ProxyProvider(`${endStrippedCurrentUrl}/GraphProxy`);
+    Providers.globalProvider = new ProxyProvider(`${endStrippedCurrentUrl}/GraphProxy`, async () => {
+        return {
+            [document.head.dataset.crumbHeader as string]: document.head.dataset.crumbValue,
+        };
+    });
 })

src/main/java/com/microsoft/jenkins/azuread/AzureSecurityRealm.java

@@ -701,7 +701,7 @@ public static final class CrumbExempt extends CrumbExclusion {
         public boolean process(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
                 throws IOException, ServletException {
             String pathInfo = request.getPathInfo();
-            if (pathInfo != null && (pathInfo.equals(CALLBACK_URL) || pathInfo.endsWith("GraphProxy/v1.0/$batch"))) {
+            if (pathInfo != null && pathInfo.equals(CALLBACK_URL)) {
                 chain.doFilter(request, response);
                 return true;
             }