JIRA REST call responds with a 403

[Jan Revis]

Hi,

We have a JIRA connect plugin running in production.  We have a user who is experiencing trouble accessing certain resources.  I believe I have traced the problem to a rest call to JIRA that is resulting in an error response. It appears that calling to /api/2/issue/{issue id}?fields=attachment responses with a 403 error.  This appears to be occurring for this specific client.  When I checked the online documentation at https://docs.atlassian.com/jira/REST/latest/#api/2/issue-getIssue, the only possible error response is a 404 if the user does not have permission or the issue does not exist.  I believe this not an issue wth the JWT token, since an invalid token should result in a 401 error.  Another note, the plugin does not propagate the sub field of the JWT token so the user making the call is the plugin itself.

What conditions would result in a 403 error for this REST call?

[peterb · Accepted solution]

Hi Jan,

The 403 code means "unauthorised": JIRA knows who the user is but they're not allowed to see this resource. Most of JIRA's REST API endpoints can return HTTP 401 or 403 because most reference customer data, which may not be anonymously accessible and even not accessible to all users.

I'm unclear on whether you're making this call to the getIssue API from the user's browser or your server. If the former then this particular browser user does not have permission to see this issue. If the latter then the add-on user in this particular JIRA instance lacks permission. Either way you should detect the 403 response and do something appropriate (e.g. tell the user that they lack permission and to ask their administrator if they want to get permission).

-Peter