JIRA Rest API, Cookie-based authentication with a session token

[Elvira Safina]

Hi guys!

 It looks like cookie based authentication is deprecated for Jira Cloud for 2+ years:

https://developer.atlassian.com/cloud/jira/platform/deprecation-notice-basic-auth-and-cookie-based-auth/ 

Is this also applies to same-browser cookie-based auth with cloud.session.token?

Because it still works for us. We just send a Get request to /rest/auth/1/session and then access any endpoint.

Could you please give some recommendations if we should use API Token authentication instead or if everything will work this way?

[Earl McCutcheon · Accepted solution]

Hello @Elvira Safina ,

Browser APIs (AKA: web APIs) is built-in to the browser and work via a web request using the browser's active session token for the authentication, so if you are logged into Jira via the browser's session the API call will work over that session without any additional login requirements as the session header is passed along from the browser built-in API functionality. 

Alternatively, if you are connecting from a scripted function or external application (i.e. curl command from terminal or app like Postman), this will require the API token to pass the additional credentials into the call for the external verification.  

Regards,
Earl

[Elvira Safina]

Got it, thanks, Earl