nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Securing Jira Webhooks

Faina Dsouza_8bvq0e

I've spent some time reading through Atlassian's doc and there doesn't seem to be a simple way to do what I want. Basically, I want to configure a webhook to send a message to my app every time a ticket is closed.

I want to do this using SSL (of course) which seems fine although I may occasionally need to send responses from Jira to hosts with self signed certificates (I cannot control this unfortunately).

Also, I really want to include a signing token or API key or some other authentication mechanism that will allow my app to verify the webhook request from Jira.

It seems that I can only do this with Connect which means (I think) that I need to create and publish a marketplace app, which is a lot more than I'd like to do.

I need to something similar in Slack for example and Slack provides a signing mechanism to verify its requests.

tl;dr is there an easy way to do this with Webhooks or do I have to use Connect or something like Zapier? I suppose embedding a secret in the URL would work but that is far from ideal, for obvious reasons.

Thanks

Accepted answers

Daniel Eads

Hi @Faina Dsouza , welcome to the Community!

First, I'm making the assumption that you're asking about Jira Cloud, vs the on-prem Jira Server/Data Center products.

Jira Cloud's built-in webhooks can handle sending requests over SSL to hosts using publicly signed certificates. You will run into some trouble with self-signed certificates. Adding certificates to the local trust store is the general way to handle this with self-hosted applications, however the shared nature of Jira Cloud prevents self-signed certificates from being added to the trust store. What I would recommend in this situation is to see if you can move from self-signed certificates to Let's Encrypt , which provides free publicly-signed certificates that can be deployed and renewed in an automated fashion. Let's Encrypt certificates are trusted by Jira Cloud.

Authentication is a bit trickier. Jira's built-in webhooks do not provide a mechanism for authenticating the webhook, as listed in this open feature request. Instead, you could create an Automation rule which fires a webhook. Automation's "Send web request" action has parameters for authorizing a webhook as well as adding other headers if you need. Automation is included with Jira Cloud; there are some limits on the number of times a rule can run per month depending on your subscription tier. However, you can create rules that run only on single projects and get unlimited executions if you're finding you need to run the rule more often than your subscription tier allows for "global" rules (which run on all projects in Jira).