Removing the About JIRA information until a user has logged in

[Rich Wolverton]

Can we turn off the About JIRA information until a user has logged in?

It has been identified as a potential security risk to display information about our JIRA site until a user has logged in. Is there a way to remove it from the login page. 

[Florian]

Hi Rich,

you can do it in the file system. There is a jar file that can be unpacked. The you have to modify the content and pack it again. Then pray that you did not break anything and restart Jira. With the next update you have to repeat it. So basically this is not a good idea for a production environment. 

Better you place your server behind a web application firewall that hides your Jira behind a login page. We use SOPHOS UTM and it works well. There are two drawbacks: It is hard to find consulting. We asked the ten largest Atlassian platinum partners in Germany and none of them was able to help for the setup. So we had to figure it out for ourself. Second drawback: Your users have to use the browser. The mobile apps on smartphones are unable to connect through the firewall. So we use the web application firewall for external partners. Internal users use VPN when they are on the road.  

Good luck

[Florian]

You can also do some cheap trick and add an announcement banner (system settings). The announcement banner can contain CSS and JavaScript to modify the rendered output. Of course this is works on the client side after the complete login page is transmitted. So this will only protect you from very poor hackers. 

[Rich Wolverton]

Thanks Florian. We are starting to use the Mobile app so putting JIRA behind another firewall is probably a non starter. It just seems a little callous  on Atlassian's to publicly provide version data for the core application software. 

[Daniel Ebers]

In case you have a reverse proxy in place you probably can block the whole "about" page for user access. This might apply to logged in users as well but in case the information on this page is neglectable for your users - it could be a valid opportunity.

Just for completeness: there is a Suggestion open with Atlassian to not show so much information to not logged-in users. Although your specific requirement is not listed there it could make sense to upvote the issue.

• JIRA provides many information to anonymous users
  https://jira.atlassian.com/browse/JRASERVER-43726

Cheers,
Daniel