Why does give two difference response for same API ?

Question

I am creating a jira cloud app using the node.js express framework. Although I call GET /rest/api/3/myself API in client-side, It sends current user details(my information),  when I call it in server-side, it sends a different response which does not contain my email address or any other information. Two difference 'accountID's are responded in these two cases.

Andy Heinzer · Answer

Looking at the code for both of these I can't tell how authentication is being handled here for these requests.  There is no apparent authentication headers, tokens, or other revealing authentication means here.   I think that is the key to understanding the results of the endpoint GET /rest/api/3/myself.  The description of that endpoint is

Returns details for the authenticated user.

In this case, for a Cloud add-on it sounds like the add-on is not attempting to authenticate as other users, which in turn would explain why it returns the addon user instead.

Looking towards our developer community, I found this thread: https://community.developer.atlassian.com/t/how-to-authenticate-end-user-in-connect-add-on-accessed-standalone/18422

Which would seem to suggest the use of 3LO to achieve this https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/?utm_source=%2Fcloud%2Fjira%2Fplatform%2Fthree-legged-oauth%2F&utm_medium=301

Kumudu_Samarakoon · Answer

Hi Andy,

Thanks for your answer, Here I used this code on the client side,

AP.require('request', function(request) {
 request({
 url: '/rest/api/3/myself',
 contentType: "application/json", 
 success: function(response) {
 // Convert the string response to JSON 
  response = JSON.parse(response); 
  username = response.emailAddress; 
  console.log(response); }, 
  error: function(response){
  console.log("error"); 
  } 
 }); 
});

this returns correct current user, But in the server side, I used the following code,

this does not return current user details, it returns addon_user details for all users. How can get current user in server-side..? please help me.

Andy Heinzer · Answer

I believe this is due to the recent/upcoming changes to the Jira Cloud REST APIs documented in https://developer.atlassian.com/cloud/jira/platform/api-changes-for-user-privacy-announcement/

These are largely happening to make sure that Jira Cloud can continue to comply with GDPR regulations.

As for why these are different, I would like to know more about your client side vs server side difference here.   How are each of these authenticating to the REST API for example?  I suspect that when a user makes a REST API call from something like curl, python, etc,  If they have authenticated Basic authentication or with a single user token, it's very clear to Jira that this user account logged in and in turn it's ok to return that own user his or her name or other personally identifiable information.  It's your own info after all.

However, if I recall correctly, the way user authentication of accounts in a cloud side environment, such as a Jira Cloud plugin, these tend to use a different method of authenticating the request, such as a oauth.  Also since some plugins can have to interface with multiple individual accounts in that Cloud site, it is not always safe (or GDPR compliant) to return to the plugin the direct name of the user account being using to make the request.  Which is what I am suspecting is happening here.

I hope this helps.

Andy