How to secure our custom build Rest Endpoints in our custom build Jira Plugin?

Question

Hi Team,

We have developed a custom build Jira plugin where we are making use of Atlassian Rest Plugin module to build custom rest endpoints to access our plugin and to access the data stored in active objects.

We want to secure our rest endpoints so that there would be no security impact on data. Can you please check and guide us on how to make our endpoints more secure and vulnerable free?

If possible, can you please attach any reference guides using which we can add more security to our rest endpoints?

Nic Brough -Adaptavist- · Answer

You need to explain what you mean by "more secure" - what do you want to do that would make this call "more secure"?

unknown · Answer

Below is the code snippet that I have written to fetch data stored in Active Objects using Rest Endpoint: JIRA_BASE_URL + "/debug/fetch/rules" Currently I have added one validation to check if user hitting endpoint is System admin, If user is system admin only then data will be fetched. Other than this is there any other possible ways which can add more security to the endpoint? @GET @Path("/debug/fetch/rules") public String fetchAllRules() { final JiraAuthenticationContext authenticationContext = ComponentAccessor.getJiraAuthenticationContext(); ApplicationUser currentUser = authenticationContext.getLoggedInUser(); boolean ifUserIsSystemAdmin = isUserSystemAdmin(currentUser); if (ifUserIsSystemAdmin) { ObjectMapper mapper = new ObjectMapper(); String data = null; List> rulesList = new ArrayList<>(); List rules = rule.getRules(); for (fieldRules rule : rules) { List ruleData = new ArrayList<>(); ruleData.add("Rule Id : " + rule.getID()); ruleData.add("Title : " + rule.getTitle()); ruleData.add("projectId : " + rule.getPid()); rulesList.add(ruleData); } try { data = mapper.writeValueAsString(rulesList); } catch (Exception e) { log.error("Exception occurred while fetching rules: " + e.getMessage()); } log.warn(rulesList.size() + " rules stored in field Rules table are fetched"); return data; } return "Not Authorized"; } // To check if user is system admin or not private boolean isUserSystemAdmin(final ApplicationUser currentUser) { return globalPermissionManager.hasPermission(GlobalPermissionKey.SYSTEM_ADMIN, currentUser); }

Nic Brough -Adaptavist- · Answer

I'm afraid repeating what you said before does not help explain what you think you want to do here.

What do you think you want to do to make them "more secure"?  Please explain that?