nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Why can this user log work via the web interface but gets a 403 over REST?

Jan Thomä

We have a project where external contractors are supposed to log work on tickets they work on. We have set the project up such that every user who is part of the "Developer" project role:

Now we added the contractor the the "Developer" project role and he can indeed log work in Jira directly (in the browser). In addition we have a time tracking tool that is integrated with Jira using Oauth and the Jira REST client library.

Now if this same contractor who can log work just fine in the web interface tries to do this using the REST client, he gets a 403. He can read issues in the project just fine on the REST client so in general the token seems to work but logging work yields a 403 every time. Is there some special set of permissions that kick in when you use the REST client vs the web interface and that I need to configure somehow?

We're using a self-hosted Jira 7.12.3.

Accepted answers

All comments

Elifcan Cakmak

Hello,

What is the response text for the request? First thing that came to my mind, for example, is this: if it's something like XSRF Check Failed, then users should add this as header to their request:

{"X-Atlassian-Token": "nocheck"}

Regards.

Jan Thomä

It's just a 403 forbidden without any response text. The response body is empty.

Elifcan Cakmak

OK, so did you try the solution I recommended? There is no extra permission for a user to use the rest api, so there must be something missing from the way these users are using it. If they can do something on the interface, they should be able to do it via rest api. You are saying he can get the issues just fine, so he can use GET request without a problem. But he has problems with POST request. That's why my solution made sense to me.

Jan Thomä

I will try adding the header. It's strange though that other users who are in the `tallence` group can use the POST API just fine, it's just this single user acting up. In any case, I'll try the header and see if that works.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-server