How does CSRF protection work in the new Jenkins?

Question

Jenkins

The client is written in C++ (Qt, cURL) and works like this.
1. Goes to
http://localhost:8080/crumbIssuer/api/xml
2. Parses XML and gets a string

Jenkins-Crumb: 3de9f4007192ee43a96f2f04a0c2a161a03b26d83259c1448c220a5cd43ee766

3. Goes on

http://localhost:8080/job/project/buildWithParameters?token=build

with a POST form (which contains the Mercurial version number) and the above Jenkins-Crumb header.
It worked like this for almost a year. And at this third step, after updating 2.176.1 → 2.190.2, it started to crash with the error “No valid crumb was included in the request”.
Jetty server, BASIC authorization, no HTTPS.

Answer 1

If Jenkins is not open to the outside, then you can simply disable the "Prevent Cross Site Request Forgery" checkbox.