Authentication not required for /project end-point

[pyther]

I can add https://jenkins.example.com/project/website/olcf as a web hook and builds get triggered when a webhook event occurs. As you can see no auth credentials are used.

I have tried this using the following authorization strategies. Matrix-based securityand Logged-in users can do anything.

Is this a bug or designed behavior? If it is designed behavior I'll open a ticket with gitlab as the Username and Password field should be remove from the JenkinsCI Service configuration page.

[omehegan]

I only recently became aware of the fact that we are not authenticating the build trigger at all. Resolving this is a high priority, but doing so is going to break every existing installation of the plugin. I expect a lot of tears.