"XSRF check failed" when creating an issue in Jira Onpremise

[Sravan]

Hello,

We installed the data gateway on the VM to connect with Jira On-premises and successfully tested the gateway using in-built "File Systems" in Power Automate Cloud flow. However, when attempting to create an issue using a custom connector in Power Automate through the data gateway with basic authentication (username and password), we encountered an XSRF failed 403 error during testing.

Could you please advise on how to resolve this issue?
Thank you.

[Alexander Nilsson]

Hello Sravan, 

in Jira Data Center, a 403 XSRF failure when calling REST (for example via a custom connector through the data gateway) is very often related to load balancer / reverse proxy configuration, not to basic auth itself.

One common root cause is that session stickiness (session affinity) is not correctly configured on the reverse proxy or load balancer in front of Jira. Jira requires that all requests for the same user session are routed to the same node, typically using the JSESSIONID cookie. If the gateway / proxy sends different requests of the same flow to different Jira nodes, Jira may see a different session/XSRF token and respond with a 403 XSRF failed error.

Things to check:
- Ensure that your reverse proxy / load balancer has sticky sessions (node affinity) enabled.
- Make sure stickiness is based on the JSESSIONID (or equivalent) cookie and that this cookie is not being stripped, renamed, or modified.
- Temporarily bypass the proxy / load balancer and send the request directly to a single Jira node; if the XSRF error disappears, it strongly indicates an issue with stickiness on the proxy/LB.

Atlassian has a KB that describes this behavior and the requirement for session stickiness in Jira Data Center:
“XSRF Security Token Missing or session expiring in Jira Data Center”
(https://support.atlassian.com/jira/kb/xsrf-security-token-missing-or-session-expiring-in-jira-data-center/)

If stickiness is already configured, it’s worth capturing the HTTP traffic (including cookies) during the failing call to verify that the same JSESSIONID is sent and that all requests of the flow are hitting the same Jira node.

Greetings,

Alex