nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Locking down the JIRA API - ramifications

Taylor Huston_f18ziu

Hi all,

Per the security requirements of the team I am working with, there can't be any kind of external API access. So far the best way to solve this, that I have came up with, is to block that at the Apache Proxy (different VM) level for anything that's an external IP. IE, I have this in my Apache Virtual Host:

<Location "/rest/api/2/" >
Order Deny,Allow
Deny from all
Allow from 10.
</Location>

Initial testing looks good, but are there any ramifications I am not thinking of? Could it potentially break any Add-ons, for example?

Accepted answers

All comments

David Yu

I believe sometimes the browser itself will make calls to /rest/api/2. For example, just loading the Rapid Boards I can see a request to /rest/api/2/project.

Maybe you could inspect the referrer as most browser generated ones will have a value?

I guess this is good preventative measure to prevent users from integrating a cloud service without permission since most will operate via the rest api. Is that the main goal?

Tzu Hau Chai_vgozzh

Do you have any users that uses JIRA externally? I doubt you can do this unless all your user base only access JIRA internally, as there are rest api calls as well during normal usage.

Nic Brough -Adaptavist-

You will need to allow REST calls to all your users, or dashboards, gadgets and integrations will fail.

However, your security requirements are based on faulty understanding. The REST API is simply a (slightly less functional) interface on to the web-ui. There is no point in blocking it because everything you can do with REST can be done by a user with a browser. REST respects the permissions and security that you set up for UI users.

Blocking REST provides you absolutely no security benefits, it just breaks stuff.

Taylor Huston_zhuc4t

Wrong account

Taylor Huston_zhuc4t

Ugh wrong account

Taylor Huston_f18ziu

There is currently 2FA SAML in front of JIRA for the web-ui. Using the Rest API with Basic Auth bypasses that and that's a security no-go here.

Taylor Huston_f18ziu

Yeah, but I THINK that can be avoided with the subnet rules. I am hoping that as long as I allow api calls from localhost, it should be fine. Hoping.

David Yu

That won't be enough as the requests will not be coming from localhost. They'll be coming from the end-user.

Somewhat related but you may also be interested in this:

https://community.atlassian.com/t5/Jira-questions/What-s-the-best-way-to-require-login-on-every-page/qaq-p/765834#M248511