ScriptListener GET request for Jira API Search query fails and returns status Unauthorized

Question

Currently

I have a GET request in ScriptRunner listener that looks like:

def jql = URLEncoder.encode("issue in (" + children.join(",") +")", "UTF-8");
//restrict GET request to minimum required fields
def fieldQuery = "&fields=issuelinks,customfield_10121,summary,customfield_10083,customfield_10122"
def response = get("/rest/api/2/search?jql=" + jql + "&startAt=0&maxResults=1000" + fieldQuery)

Issue

The above request fails with log message:

2019-07-30 23:33:56.165 WARN - GET request to /rest/api/2/search?jql=issue+in+%28PD-3874%2CPD-3396%2CPD-2335%2CPD-3008%2CPD-2549%2CPD-2691%2CPD-2755%2CPD-2780%2CPD-2851%2CPD-3415%2CPD-3648%2CPD-3810%2CPD-3884%2CPD-3886%2CMAP-326%2CMAP-329%2CMAP-104%2CMAP-83%2CMAP-84%2CMAP-85%2CMAP-86%2CMAP-87%2CMAP-88%2CMAP-89%2CMAP-229%2CMAP-243%29&startAt=0&maxResults=1000&fields=issuelinks,customfield_10121,summary,customfield_10083,customfield_10122 returned an error code: status: 401 - Unauthorized
body: java.lang.RuntimeException: com.fasterxml.jackson.databind.exc.MismatchedInputException: No content to map due to end-of-input
 at [Source: (String)""; line: 1, column: 0]

Question

Why is this Search GET request returning unauthorized, but if I make a REST API request for a single issue i.e.

def response = get("/rest/agile/1.0/issue/${issueKey}")

...there is no issue.

What can I do to get my Search request working?

alexmears · Answer

@Tom _Automation Consultants_

Due to you searching for Issues, Jira needs to know your credentials to verify if you should even be allowed to see the issues

^^ this still doesn't make sense to me. Because a request for a single issue ie.

def response = get("/rest/agile/1.0/issue/${issueKey}")

doesn't require this authoriziation with username + password.

Is there documentation that confirms that a REST API get request for /search requires username + password authoriziation for ScriptRunner Listener?

Tom _Automation Consultants_ · Answer

I understand that it's a huge security flaw and I believe Atlassian are trying to address it.

I'm not 100% sure about this behaviour but I would say that it's either:

* How Atlassian have designed their API so there's no workaround
* Due to you searching for Issues, Jira needs to know your credentials to verify if you should even be allowed to see the issues

Another workaround would be to use the Jira Java API class, JqlQueryBuilder to create the search in a coded way instead of via a REST request.

alexmears · Answer

@Tom _Automation Consultants_

are you suggesting putting my username and api key into the header of the request directly? That would expose my username and api key to anyone who has access to the ScriptRunner Listener console, and is something I would want to avoid.

Also, I still do not understand why a GET issue request from ScriptRunner listener does not require this authorization, but a GET search request does.