Restrict Access to Jira Cloud Rest End Points

Question

Hi, I want to know, if there is a way we can restrict access to certain JIRA rest endpoint in case of JIRA Cloud. I want to restrict access to anonymous end point like /rest/api/3/field I also want to restrict access to the project fetch end point /rest/api/3/project/search Thanks and Regards, Tulika

Tomislav Tobijas · Answer

@Gerusa Lobo well, I tried using Postman and thus why my previous comment.

No auth on site name/base URL combined with /rest/api/latest/field and you'll get the response.

However, it's worth noting that this seems to get system fields/info which is the same on all sites (it won't reveal any custom fields you're using).
Still, IMO, this shouldn't give a response if you're not using auth.

Gerusa Lobo · Answer

Hello @Tulika @Tomislav Tobijas

As I know, all API endpoints in Atlassian need a authentication.

https://developer.atlassian.com/cloud/jira/software/basic-auth-for-rest-apis/

I don't know any Atlassian endpoint that is not required the authentication to run with success.

If you put a endpoint in a browser, you are still using the authentication using a cookie of the SSO saved on cache of the browser.

I suggest you try to proceed a get using a postman or curl without authentication to try get information from these endpoints.

Regards.

Tomislav Tobijas · Answer

Oh, I see. I just tried using some endpoints on hello.atlassian.net and it provided responses without any authorization. Wow...

I'm not sure if whitelisting would help here 👀

But I agree that this could provide security risks in some cases. I would suggest reaching out to Atlassian Support and discussing it further with them. I've tried checking JAC for any open suggestions on that topic, but I couldn't find any :/