Security on Automation for Jira incoming Webhook

Question

Is there any way to set security on the incoming Webhook in Automation for Jira? Right now, it appears that an anonymous user can call the webhook. This is a significant security concern. I need to limit who can call the web hook to authenticated users, preferably restrict it to a specific project role, user group or specific user.

said kouzibry · Answer

Unfortunately, as of now, there is no officially supported way to add authentication to incoming webhooks.

The only way I can think of is to use rest API to edit a specific field in your target issue and use the Field value changed trigger.

You can potentially use that same field to temporarily store the data needed by the automation rule.

I understand that this might require huge refactoring, but it's seems to be the only way to workaround that limitation.

Nicolas Tagle · Answer

Hello,

Please take a look at the following community comments https://community.atlassian.com/t5/Jira-questions/how-to-provide-Bearer-token-in-webhook-url/qaq-p/1011782

In addition, here is a Atlassian feedback ticket gathering interest about Webhook authentication  that can prove useful for your security need community https://jira.atlassian.com/browse/JRACLOUD-31953

Best regards,

Nico.