diff --git a/core/src/main/java/hudson/Functions.java b/core/src/main/java/hudson/Functions.java
index a34afa183a..71c21e6bbf 100644
--- a/core/src/main/java/hudson/Functions.java
+++ b/core/src/main/java/hudson/Functions.java
@@ -1172,13 +1172,7 @@ public class Functions {
     	if (isAutoRefresh(req)) {
     		builder.append("null");
     	} else {
-    		builder.append("'return replaceDescription(");
-    		builder.append("\\'");
-    		builder.append(getCrumbRequestField());
-    		builder.append("\\',\\'");
-    		builder.append(getCrumb(req));
-    		builder.append("\\'");
-    		builder.append(");'");
+    		builder.append("'return replaceDescription();'");
     	}
     	return builder.toString();
     }
diff --git a/core/src/main/java/hudson/model/DownloadService.java b/core/src/main/java/hudson/model/DownloadService.java
index 8befdb0e77..d8945c3219 100644
--- a/core/src/main/java/hudson/model/DownloadService.java
+++ b/core/src/main/java/hudson/model/DownloadService.java
@@ -3,7 +3,6 @@ package hudson.model;
 import hudson.Extension;
 import hudson.ExtensionList;
 import hudson.ExtensionPoint;
-import hudson.security.csrf.CrumbIssuer;
 import hudson.util.QuotedStringTokenizer;
 import hudson.util.TextFile;
 import hudson.util.TimeUnit2;
@@ -39,22 +38,9 @@ public class DownloadService extends PageDecorator {
         StringBuilder buf = new StringBuilder();
         if(Hudson.getInstance().hasPermission(Hudson.READ)) {
             long now = System.currentTimeMillis();
-            CrumbIssuer ci = Hudson.getInstance().getCrumbIssuer();
-            String crumbName = null;
-            String crumb = null;
-            if(ci!=null) {
-                crumbName = ci.getCrumbRequestField();
-                crumb = ci.getCrumb();
-            }
             for (Downloadable d : Downloadable.all()) {
                 if(d.getDue()<now) {
-                    buf.append("<script>");
-                    if(ci!=null) {
-                        buf.append("downloadService.crumbName="+QuotedStringTokenizer.quote(crumbName))
-                           .append(";downloadService.crumb="+QuotedStringTokenizer.quote(crumb))
-                           .append(';');
-                    }
-                    buf.append("downloadService.download(")
+                    buf.append("<script>downloadService.download(")
                        .append(QuotedStringTokenizer.quote(d.getId()))
                        .append(',')
                        .append(QuotedStringTokenizer.quote(d.getUrl()))
diff --git a/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java b/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java
index ba712a049d..fe8847069a 100644
--- a/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java
+++ b/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java
@@ -75,43 +75,4 @@ public abstract class CrumbIssuerDescriptor<T extends CrumbIssuer> extends Descr
             crumbRequestField = requestField;
         }
     }
-
-    @Override
-    public boolean configure(StaplerRequest request) {
-        setCrumbSalt(request.getParameter("csrf_crumbSalt"));
-        setCrumbRequestField(request.getParameter("csrf_crumbRequestField"));
-        save();
-
-        return true;
-    }
-
-    /**
-     * Returns the Jelly script that contains common configuration.
-     */
-    @Override
-    public final String getConfigPage() {
-        return getViewPage(CrumbIssuer.class, "config.jelly");
-    }
-
-    /**
-     * Returns a subclass specific configuration page. The base CrumbIssuerDescriptor
-     * class provides configuration options that are common to all crumb issuers.
-     * Implementations may provide additional configuration options which are
-     * kept in Jelly script file tied to the subclass.
-     * <p>
-     * By default, an empty string is returned, which signifies no additional
-     * configuration is needed for a crumb issuer. Override this method if your
-     * crumb issuer has additional configuration options.
-     * <p>
-     * A typical implementation of this method would look like:
-     * <p>
-     * <code>
-     * return getViewPage(clazz, "config.jelly");
-     * </code>
-     *
-     * @return An empty string, signifying no additional configuration.
-     */
-    public String getSubConfigPage() {
-        return "";
-    }
 }
diff --git a/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java b/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java
index d2e635d8e1..4b0636c500 100644
--- a/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java
+++ b/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java
@@ -58,8 +58,7 @@ public class DefaultCrumbIssuer extends CrumbIssuer {
                 buffer.append(req.getRemoteAddr());
 
                 md.update(buffer.toString().getBytes());
-                md.update(salt.getBytes());
-                byte[] crumbBytes = md.digest(Hudson.getInstance().getSecretKey().getBytes());
+                byte[] crumbBytes = md.digest(salt.getBytes());
 
                 StringBuilder hexString = new StringBuilder();
                 for (int i = 0; i < crumbBytes.length; i++) {
@@ -93,13 +92,13 @@ public class DefaultCrumbIssuer extends CrumbIssuer {
     public static final class DescriptorImpl extends CrumbIssuerDescriptor<DefaultCrumbIssuer> implements ModelObject {
 
         public DescriptorImpl() {
-            super(null, null);
+            super(Hudson.getInstance().getSecretKey(), System.getProperty("hudson.security.csrf.requestfield", ".crumb"));
             load();
         }
 
         @Override
         public String getDisplayName() {
-            return "Default Crumb Issuer";
+            return Messages.DefaultCrumbIssuer_DisplayName();
         }
 
         public DefaultCrumbIssuer newInstance(StaplerRequest req, JSONObject formData) throws FormException {
diff --git a/core/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly b/core/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly
index e30118fe9d..3b4a4633a8 100644
--- a/core/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly
+++ b/core/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly
@@ -35,8 +35,6 @@ THE SOFTWARE.
       updateCenter.postBackURL = "${rootURL}/updateCenter/postBack";
       updateCenter.info = { version:"${h.version}" }; 
       updateCenter.url = "${h.updateCenterUrl}";
-      updateCenter.crumbName = "${h.getCrumbRequestField()}";
-      updateCenter.crumb = "${h.getCrumb(request)}";
       Behaviour.addLoadEvent(updateCenter.checkUpdates);
     </script>
   </j:if>
diff --git a/core/src/main/resources/hudson/security/csrf/CrumbIssuer/config.jelly b/core/src/main/resources/hudson/security/csrf/CrumbIssuer/config.jelly
deleted file mode 100644
index c1329f7366..0000000000
--- a/core/src/main/resources/hudson/security/csrf/CrumbIssuer/config.jelly
+++ /dev/null
@@ -1,36 +0,0 @@
-<!--
-The MIT License
-
-Copyright (c) 2008-2009, Yahoo! Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
--->
-
-<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
-    <f:entry title="${%Salt}" help="/help/security/csrf/salt.html">
-        <f:textbox name="csrf_crumbSalt" value="${descriptor.crumbSalt}" />
-    </f:entry>
-    <f:entry title="${%Request Field}" help="/help/security/csrf/field.html">
-        <f:textbox name="csrf_crumbField" value="${descriptor.crumbRequestField}" />
-    </f:entry>
-    
-    <j:if test="${!empty(descriptor.subConfigPage)}">
-        <st:include from="${descriptor}" page="${descriptor.subConfigPage}" optional="true" />
-    </j:if>
-</j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/hudson/security/csrf/Messages.properties b/core/src/main/resources/hudson/security/csrf/Messages.properties
new file mode 100644
index 0000000000..1c5613c465
--- /dev/null
+++ b/core/src/main/resources/hudson/security/csrf/Messages.properties
@@ -0,0 +1,23 @@
+# The MIT License
+#
+# Copyright (c) 2008-2009, Yahoo! Inc.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+DefaultCrumbIssuer.DisplayName=Default Crumb Issuer
diff --git a/core/src/main/resources/hudson/widgets/HistoryWidget/index.jelly b/core/src/main/resources/hudson/widgets/HistoryWidget/index.jelly
index 12aaa5c616..53c65208dc 100644
--- a/core/src/main/resources/hudson/widgets/HistoryWidget/index.jelly
+++ b/core/src/main/resources/hudson/widgets/HistoryWidget/index.jelly
@@ -83,6 +83,6 @@ THE SOFTWARE.
     </tr>
   </l:pane>
   <script defer="true">
-    updateBuildHistory("${it.baseUrl}/buildHistory/ajax",${it.nextBuildNumberToFetch},"${h.getCrumbRequestField()}","${h.getCrumb(request)}");
+    updateBuildHistory("${it.baseUrl}/buildHistory/ajax",${it.nextBuildNumberToFetch});
   </script>
 </j:jelly>
\ No newline at end of file
diff --git a/core/src/main/resources/lib/hudson/executors.jelly b/core/src/main/resources/lib/hudson/executors.jelly
index aabf83ae25..241c769154 100644
--- a/core/src/main/resources/lib/hudson/executors.jelly
+++ b/core/src/main/resources/lib/hudson/executors.jelly
@@ -120,7 +120,7 @@ THE SOFTWARE.
     <!-- schedule updates only for the full page reload -->
     <j:if test="${ajax==null and !h.isAutoRefresh(request) and h.hasPermission(app.READ)}">
       <script defer="defer">
-        refreshPart('executors',"${h.hasView(it,'ajaxExecutors')?'.':rootURL}/ajaxExecutors", "${h.getCrumbRequestField()}", "${h.getCrumb(request)}");
+        refreshPart('executors',"${h.hasView(it,'ajaxExecutors')?'.':rootURL}/ajaxExecutors");
       </script>
     </j:if>
 	</l:pane>
diff --git a/core/src/main/resources/lib/hudson/project/matrix.jelly b/core/src/main/resources/lib/hudson/project/matrix.jelly
index 231383c527..6ea982d085 100644
--- a/core/src/main/resources/lib/hudson/project/matrix.jelly
+++ b/core/src/main/resources/lib/hudson/project/matrix.jelly
@@ -94,7 +94,7 @@ THE SOFTWARE.
     </j:choose>
     <j:if test="${ajax==null and attrs.autoRefresh and !h.isAutoRefresh(request)}">
       <script defer="defer">
-        refreshPart('matrix',"./ajaxMatrix","${h.getCrumbRequestField()}","${h.getCrumb(request)}");
+        refreshPart('matrix',"./ajaxMatrix");
       </script>
     </j:if>
   </div>
diff --git a/core/src/main/resources/lib/hudson/queue.jelly b/core/src/main/resources/lib/hudson/queue.jelly
index 0dde2f8a60..3200cc513b 100644
--- a/core/src/main/resources/lib/hudson/queue.jelly
+++ b/core/src/main/resources/lib/hudson/queue.jelly
@@ -82,7 +82,7 @@ THE SOFTWARE.
     <!-- schedule updates only for the full page reload -->
     <j:if test="${ajax==null and !h.isAutoRefresh(request) and h.hasPermission(app.READ)}">
       <script defer="defer">
-        refreshPart('buildQueue',"${h.hasView(it,'ajaxBuildQueue')?'.':rootURL}/ajaxBuildQueue", "${h.getCrumbRequestField()}", "${h.getCrumb(request)}");
+        refreshPart('buildQueue',"${h.hasView(it,'ajaxBuildQueue')?'.':rootURL}/ajaxBuildQueue");
       </script>
     </j:if>
   </l:pane>
diff --git a/core/src/main/resources/lib/layout/layout.jelly b/core/src/main/resources/lib/layout/layout.jelly
index b8606cac69..e443d4c46a 100644
--- a/core/src/main/resources/lib/layout/layout.jelly
+++ b/core/src/main/resources/lib/layout/layout.jelly
@@ -105,6 +105,10 @@ THE SOFTWARE.
     <!--l:yui module="editor" suffix="-beta" /-->
 
     <script src="${resURL}/scripts/hudson-behavior.js" type="text/javascript"></script>
+
+    <script>
+        crumb.init("${h.getCrumbRequestField()}", "${h.getCrumb(request)}");
+    </script>
     
     <link rel="stylesheet" href="${resURL}/scripts/yui/container/assets/container.css" type="text/css"/>
     <link rel="stylesheet" href="${resURL}/scripts/yui/assets/skins/sam/skin.css" type="text/css" />
diff --git a/war/resources/help/security/csrf/field.html b/war/resources/help/security/csrf/field.html
deleted file mode 100644
index cb6dc75fe5..0000000000
--- a/war/resources/help/security/csrf/field.html
+++ /dev/null
@@ -1,4 +0,0 @@
-<div>
-  This is name of the request parameter Hudson will look in for a crumb
-  value. 
-</div>
\ No newline at end of file
diff --git a/war/resources/help/security/csrf/salt.html b/war/resources/help/security/csrf/salt.html
deleted file mode 100644
index fb20b96e49..0000000000
--- a/war/resources/help/security/csrf/salt.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<div>
-  The salt value is taken as an input to the crumb generation algorithm. It acts
-  as further randomization to complicate dictionary style attacks against the
-  algorithm. In the context of CSRF exploits against Hudson servers, each Hudson
-  server should use a different salt value. If multiple Hudson servers all use
-  a crumb generation algorithm that gets broken, the salt prevents an attacker
-  from running CSRF exploits against all these servers.
-</div>
diff --git a/war/resources/scripts/hudson-behavior.js b/war/resources/scripts/hudson-behavior.js
index 09e63cfc68..6cd1523210 100644
--- a/war/resources/scripts/hudson-behavior.js
+++ b/war/resources/scripts/hudson-behavior.js
@@ -38,6 +38,17 @@ function object(o) {
 // id generator
 var iota = 0;
 
+// crumb information
+var crumb = {
+    fieldName: null,
+    value: null,
+
+    init: function(crumbField, crumbValue) {
+        this.fieldName = crumbField;
+        this.value = crumbValue;
+    }
+}
+
 // Form check code
 //========================================================
 var FormChecker = {
@@ -72,6 +83,7 @@ var FormChecker = {
         if (params.method == "post") {
             var idx = url.indexOf('?');
             params.parameters = url.substring(idx + 1);
+            params.parameters[crumb.fieldName] = crumb.value;
             url = url.substring(0, idx);
         }
         new Ajax.Request(url, params);
@@ -623,11 +635,11 @@ function xor(a,b) {
 }
 
 // used by editableDescription.jelly to replace the description field with a form
-function replaceDescription(crumbName,crumb) {
+function replaceDescription() {
     var d = document.getElementById("description");
     d.firstChild.nextSibling.innerHTML = "<div class='spinner-right'>loading...</div>";
     var params = new Array(1);
-    params[crumbName] = crumb;
+    params[crumb.fieldName] = crumb.value;
     new Ajax.Request(
         "./descriptionForm",
         {
@@ -806,10 +818,10 @@ function expandTextArea(button,id) {
 
 // refresh a part of the HTML specified by the given ID,
 // by using the contents fetched from the given URL.
-function refreshPart(id,url,crumbName,crumb) {
+function refreshPart(id,url) {
     var f = function() {
     	var params = new Array(1);
-    	params[crumbName] = crumb;
+    	params[crumb.fieldName] = crumb.value;
         new Ajax.Request(url, {
             method: "post",
             parameters: params,
@@ -828,7 +840,7 @@ function refreshPart(id,url,crumbName,crumb) {
                 Behaviour.applySubtree(node);
 
                 if(isRunAsTest) return;
-                refreshPart(id,url,crumbName,crumb);
+                refreshPart(id,url);
             }
         });
     };
@@ -1080,14 +1092,14 @@ function addRadioBlock(id) {
 }
 
 
-function updateBuildHistory(ajaxUrl,nBuild,crumbName,crumb) {
+function updateBuildHistory(ajaxUrl,nBuild) {
     if(isRunAsTest) return;
     $('buildHistory').headers = ["n",nBuild];
 
     function updateBuilds() {
         var bh = $('buildHistory');
     	var params = new Array(1);
-    	params[crumbName] = crumb;
+    	params[crumb.fieldName] = crumb.value;
         new Ajax.Request(ajaxUrl, {
             requestHeaders: bh.headers,
             method: "post",
@@ -1121,9 +1133,9 @@ function updateBuildHistory(ajaxUrl,nBuild,crumbName,crumb) {
 
 // send async request to the given URL (which will send back serialized ListBoxModel object),
 // then use the result to fill the list box.
-function updateListBox(listBox,url,crumbName,crumb) {
-	var params = new Array(1);
-	params[crumbName] = crumb;
+function updateListBox(listBox,url) {
+    var params = new Array(1);
+    params[crumb.fieldName] = crumb.value;
     new Ajax.Request(url, {
         method: "post",
         parameters: params,
@@ -1513,8 +1525,6 @@ function loadScript(href) {
 
 var downloadService = {
     continuations: {},
-    crumbName: null,
-    crumb: null,
 
     download : function(id,url,info, postBack,completionHandler) {
         this.continuations[id] = {postBack:postBack,completionHandler:completionHandler};
@@ -1525,7 +1535,7 @@ var downloadService = {
         var o = this.continuations[id];
         var params = new Array(2);
         params["json"] = Object.toJSON(data);
-        params[downloadService.crumbName] = downloadService.crumb;
+        params[crumb.fieldName] = crumb.value;
         new Ajax.Request(o.postBack, {
             method:"post",
             parameters:params,
@@ -1543,8 +1553,6 @@ var updateCenter = {
     postBackURL : null,
     info: {},
     completionHandler: null,
-    crumbName: null,
-    crumb: null,
     url: "https://hudson.dev.java.net/",
 
     checkUpdates : function() {
@@ -1554,7 +1562,7 @@ var updateCenter = {
     post : function(data) {
     	var params = new Array(2);
     	params["json"] = Object.toJSON(data);
-    	params[updateCenter.crumbName] = updateCenter.crumb;
+    	params[crumb.fieldName] = crumb.value;
         new Ajax.Request(updateCenter.postBackURL, {
             method:"post",
             parameters:params,
@@ -1612,6 +1620,7 @@ function validateButton(checkUrl,paramList,button) {
 
   var parameters = {};
 
+  parameters[crumb.fieldName] = crumb.value;
   paramList.split(',').each(function(name) {
       var p = findPreviousFormItem(button,name);
       if(p!=null)