Securing anonymous ticket creation

Sumith Sreedhar

I have enabled anonymous users to create Jira tickets , the problem is that when some anonymous user create an issue with the Jira user's email address as the contact address, the Jira ticket shows Jira user as the reporter, which may be a security issue as jira user can be impersonated.

I don't want to disable anonymous users tickets as well. What are the recommended ways to secure anonymous ticket creations? 

Oday Rafeh_2jhprw

Hey Srs, welcome aboard!

Balancing anonymous reporting with security can be tricky. Here's how to tighten things up:

Stop Email Spoofing (Kind Of):

Jira can't magically block fake email addresses, but you can make it harder. Enable “Email Validation” during anonymous ticket creation. This ensures a proper email format (think [email address removed]) but doesn't guarantee it's real.

Consider CAPTCHAs (Optional):

Adding CAPTCHAs to the anonymous form throws a wrench into automated bots that might try to misuse the system.

Lock Down Anonymous Access:

By default, anonymous users have limited permissions. You can make things even tighter by:

Project Visibility: Only let anonymous users create tickets in projects with less sensitive data.
Field Permissions: Restrict which fields they can fill out in the ticket creation form.

 

Oday