API authentication using the post method

[Staffan Nilsson]

I'm trying to understand how to create a login session using the REST API with the /rest/auth/1/session POST method. My goal is to open a session and to keep it open using the cookie header in subsequent calls. Note that I am trying to use .NET and C# for this.

Unfortunatly I haven't found enough information for me to understand how to do this. I did find the reference: https://docs.atlassian.com/jira/REST/6.1.4/ but I do not understand enough how to do it. Can someone please explain?

I have been able to use basic authentication but I want to use the cookie method (need to save the login info betwen program ivocations and don't want to save the username&password combination - I'd rather save and reuse the session cookie). Please note that I'm more at home with programming embedded microcontrollers so please explain in detail :)

[Aleksander Mierzwicki · Accepted solution]

I won't provide code, as this hardly depends on used library, but will explain the idea instead ;)

You have to do only two things:

1. Enable cookies handling in library used for connecting to JIRA (so the cookies are passed from last response to next request)

2. POST your credentials as JSON to /rest/auth/1/session/, like that:

{ "username": "myuser", "password": "mypassword" }

In response you should get session information:

{"session":{"name":"JSESSIONID","value":"6E3487971234567896704A9EB4AE501F"},"loginInfo":{"failedLoginCount":1,"loginCount":2,"lastFailedLoginTime":"2013-11-27T09:43:28.839+0000","previousLoginTime":"2013-12-04T07:54:59.824+0000"}}%

But more imporant is that you'll get session cookie from server which should be used in next requests.

Set-Cookie: JSESSIONID=6E3487971234567896704A9EB4AE501F; Path=/; HttpOnly

As you see cookie name and value are the same as in session reply - this can be used to set cookie header manualy in next requests.

If authentication request passes but next request returns not authorized then probably something is wrong with cookies passing ;).

If you get 'Unsupported Media Type' then verify that there the Content-Type is set to application/json in request headers.

[Jason Nguyen]

Can you provide some code for this working? I've yet to see any examples of any authentication with JIRA except through CURL. I need to be able to do this within JavaScript/AJAX.

[Aleksander Mierzwicki]

Please create new question and describe as much as you can what are you doing. Please also be aware of ajax cross domain request limitations.

[Lokesh Cherukuri]

How to do this with POSTMAN client. should i send credentials as Header or Form-data or  application/x-www-form-urlencoded?

[Sugandha]

Hi, 

I am able to write JIRA API via postman to create JIRA tasks using Basic Authentication

Now I wanted to use AOuth 2.0 for authentication instead of Basic

Please help me on how to proceed with this.

Regards,

Sugandha

[Mitalee Jadhav]

@Sugandha From where did you find the username for basic authentication? Have you used email id or the username which we get when we add '@' for adding comment or so? We have to pass username:password right while sending GET request? 

[Benjamin Rau]

HI all.

We host JIRA server ourselves. I am trying to setup login via session resource like Seffan did.

Everything works fine with request in Postman but as soon as i perform the POST request from Angular (what means CORS) it fails with error message: 415 Unsupported media type.

For sure i verified that Content-Type and Accept header is set. I tried by HttpModule and Restangular.

Ive also tried to set Access-Control-Allow-* headers on Apache whose doing proxy.

Happy for any help. Cheers Ben

[Upkaar Singh]

Hi Staffan, can you please send this code to me .I realy need that

Thanks.

[Staffan Nilsson]

I've now successfully obtained and used the session cookie. It works as expected. Thanks!

[Staffan Nilsson]

Thank you very much for the answer. Your reply provided the needed information. I have now been able to POST of my credentials, with a proper reply from JIRA. The next step is to get the cookie and provide it to subsequent requests. I am fairly hopeful that I will get that to work, but if necessary I will follow up with another question here.

Thanks again!