[JENKINS-71887] An anonymous call is made to GitHub URI when looking at the global config page

Whenever a user displays the the global Configuration page *Manage Jenkins > Configure System*, anonymous calls are made for each endpoint configured to check for private mode https://github.com/jenkinsci/github-branch-source-plugin/blob/1732.v3f1889a_c475b_/src/main/java/org/jenkinsci/plugins/github_branch_source/Endpoint.java#L139.

As we have seen, we should limit such kind of unauthenticated calls as it can quickly deplete the rate api limit quota. Until eventually it impacts this feature:

Handling POST /jenkins/manage/descriptorByName/org.jenkinsci.plugins.github_branch_source.Endpoint/checkApiUri from $IP : Jetty (winstone)-53801 

    at java.base@​11.0.19/java.lang.Thread.sleep(Native Method) 

    at org.kohsuke.github.RateLimitHandler$1.onError(RateLimitHandler.java:75) 

    at org.kohsuke.github.RateLimitHandler.onError(RateLimitHandler.java:44) 

    at org.kohsuke.github.GitHubClient.detectKnownErrors(GitHubClient.java:466) 

    at org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:435) 

    at org.kohsuke.github.GitHubClient.fetch(GitHubClient.java:148) 

    at org.kohsuke.github.GitHubClient.checkApiUrlValidity(GitHubClient.java:366) 

    at org.kohsuke.github.GitHub.checkApiUrlValidity(GitHub.java:1269) 

    at org.jenkinsci.plugins.github_branch_source.Endpoint$DescriptorImpl.doCheckApiUri(Endpoint.java:140) 

As well as others (org scan for example).

Maybe the cache we implemented in https://issues.jenkins.io/browse/JENKINS-69815 could be used in this context as well.

---
Originally reported by allan_burdajewicz, imported from: An anonymous call is made to GitHub URI when looking at the global config page

• status: Open
  
• priority: Minor
  
• component(s): github-branch-source-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-02
  

Raw content of original issue

Whenever a user displays the the global Configuration page *Manage Jenkins > Configure System*, anonymous calls are made for each endpoint configured to check for private mode https://github.com/jenkinsci/github-branch-source-plugin/blob/1732.v3f1889a_c475b_/src/main/java/org/jenkinsci/plugins/github_branch_source/Endpoint.java#L139.


As we have seen, we should limit such kind of unauthenticated calls as it can quickly deplete the rate api limit quota. Until eventually it impacts this feature:




Handling POST /jenkins/manage/descriptorByName/org.jenkinsci.plugins.github_branch_source.Endpoint/checkApiUri from $IP : Jetty (winstone)-53801 

    at java.base@11.0.19/java.lang.Thread.sleep(Native Method) 

    at org.kohsuke.github.RateLimitHandler$1.onError(RateLimitHandler.java:75) 

    at org.kohsuke.github.RateLimitHandler.onError(RateLimitHandler.java:44) 

    at org.kohsuke.github.GitHubClient.detectKnownErrors(GitHubClient.java:466) 

    at org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:435) 

    at org.kohsuke.github.GitHubClient.fetch(GitHubClient.java:148) 

    at org.kohsuke.github.GitHubClient.checkApiUrlValidity(GitHubClient.java:366) 

    at org.kohsuke.github.GitHub.checkApiUrlValidity(GitHub.java:1269) 

    at org.jenkinsci.plugins.github_branch_source.Endpoint$DescriptorImpl.doCheckApiUri(Endpoint.java:140) 





As well as others (org scan for example).


Maybe the cache we implemented in https://issues.jenkins.io/browse/JENKINS-69815 could be used in this context as well.