How to prevent spam?

Question

A few months ago we opened-up our JIRA instance for anonymous access so that our customers can comment on and create issues without having to log-in into JIRA (reason for that being that we only have a 25 users license and cannot afford an unlimited user license).

Unfortunately yesterday a spambot detected our page and created > 1.500 spam comments over night. The only solution I saw was to revoke the permission for anonymous comments again.

Isn't there another possibility to protect against spammers? Captcha system, moderated comments, spam-detection,...

Daniel Tomberlin · Answer

Thanks for the tips!

In waiting I reached out to support and their instructions were this:

"If you want to block the comment operation in an issue based on the status, you need to add the property jira.permission.comment.denied with the value denied to the workflow status."

So for those reading, Edit workflow and go to the Closed status and click View Properties (you must edit workflow first). Then click Add:

Property Key: jira.permission.comment.denied
Property Value: denied

After I added the property to my Closed workflow status that kept Anonymous email from entering back through that ticket (and any others that may follow that workflow). You'll know when this property is in affect when the Comment box at the bottome of a ticket profile no longer appears.

Stefan Hett_peun5z · Answer

Hopefully I'll find the time to finish writing the blog post describing this in detail at some point.

In principle what we did was to add two more workflow steps: "Closed (blocked)" and "Open (blocked)".

These steps correspond to our normal main workflow steps (i.e. "Closed" and "Open").

The steps then set the jira.permission.comment.user property to denied.

That way you get a new workflow transition which you can use on individual issues which are attacked by a spam bot to disable the comment functionality on just these issues.

Daniel Tomberlin · Answer

Hello @Stefan Hett. Can you share the steps in how you updated your workflow in "blocking comments on issues which a spambot is creating spam for individually" and maybe elaborate a bit on how this affects all my JIRA tickets. Are you basically not allowing comments to be posted after a ticket is closed status (how)?

We are having an issue with just one of our closed tickets and a handful of spam comments that are ramping up as of two days ago. If the blocking keeps comments from being posted, then you would be providing a very valuable way to block spam so that ticket comments and reporter/watchers emails of a particular ticket or ticket status will not get spammed.

Thank you in advance!