nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What is the url to create a new defect against JIRA

Subhajit Bhuiya

I want to create a new defect against JIRA. How can I do that or what the the url for it. This is the defect

In https://confluence.atlassian.com/jirakb/security-headers-in-jira-939919914.html, it is written how to exclude the security header using com.atlassian.jira.clickjacking.protection.exclude. But com.atlassian.jira.clickjacking.protection.exclude does not support regular expression. Like if I update setenv.bat with

-Dcom.atlassian.jira.clickjacking.protection.exclude=/plugins/servlet/oslcservices/adminlogin,/plugins/servlet/oslcservices/oauth/approvekey,/plugins/servlet/oslcservices/userlogin,/plugins/servlet/oslcservices/oauth/authorize

itworks. But if I change it to

-Dcom.atlassian.jira.clickjacking.protection.exclude=/*/oslcservices/*

It does not work. So, this solution works for static url. But there are few urls which are dynamic because they will have project area id or issue id. Having support for regular expression or giving a way to support dynamic url is very much required.

Accepted answers

All comments

Daniel Eads

Hey Subhajit,

We do have some known cases where characters need to be escaped or quoted when being passed in as arguments. See our documentation for examples of other arguments needing quotes.

If quoting the string doesn't work, let me know and we'll go from there.

Cheers,
Daniel

Subhajit Bhuiya

@Daniel Eads I have used quotes, but it does not work.

Daniel Eads

Another route you could take is to disable clickjacking protection entirely using the following flag instead:

-Dcom.atlassian.jira.clickjacking.protection.disabled=true

Using this flag on a production system is an extremely bad idea™ but an option you could take during development if you need it.

I'm not sure what your use-case is for development but just want to advise you that having clickjacking excluded/disabled is not something you should count on if you're planning to distribute a plugin. If it's just to help development of some other function on your local system and your plugin doesn't rely on it, then carry on.

Subhajit Bhuiya

@Daniel Eads that is what I am doing now. As you mentioned, we need -Dcom.atlassian.jira.clickjacking.protection.exclude working for dynamic urls

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

atl-dev