Rest call to JIRA in JQuery results in error No 'Access-Control-Allow-Origin' header is present on the requested resource

[Jason Nguyen]

I'm trying to do a rest call to our JIRA instance to retrieve a list of projects and then fill up a drop down with that list of products. I don't know much about about authentication and can do my rest call through the Java API but can't do it through JQuery.

I found this documentation but it confuses me so much. I have no idea what the point of the curl command is for. The curl command works for me but how do I do this through JQuery/JavaScript?

https://developer.atlassian.com/display/JIRADEV/JIRA+REST+API+Example+-+Basic+Authentication

XMLHttpRequest cannot load http://msajira.cirrus.com/rest/api/2/project?key=value. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:1990' is therefore not allowed access.

$('#server-select').on('change', function() {
          //alert( $('#Popup').attr('href')); // or $(this).val()
          var restUrl = $( '#server-select :selected').data("url")+"/rest/api/2/project";
          console.log(restUrl);

          //http://atlas-j.cirrus.com/rest/api/2/project

            $.ajax({
                beforeSend: function(xhr) {
                    xhr.setRequestHeader("Authorization", "Basic " + btoa("jxnguyen:M0n0rail"));
                },
                type: 'GET',
                url: restUrl,
                data: {
                    key: "value"
                },
                dataType: "JSON",
                success: function (xml){
                    console.log(xml);


                }
            });


        });

[Joe Clark]

This is a security feature of web browsers called Same Origin Policy. You cannot make an AJAX call to a URL that is on a different domain than where the JavaScript was loaded from (ie. has the "same origin").

There are a number of ways to work around this, the two most common ones are:

1. Serve your JavaScript from the remote server, instead of the host server.
2. Make the remote server respond with the correct Cross Origin Resource Sharing ("CORS") headers that will let the browser relax this security policy.

[Claus Gerull]

Probably found the answer here:
https://jira.atlassian.com/browse/JRA-30371

it took a while to dig that deep. 

[Bernhard Anzeletti]

ad 2) Can you pls. detail on how to convince JIRA 7.0.5 Server to do exactly this? The standard behaviour is that it just does not provide the allow-origin header, whitelist or not. 

[Claus Gerull]

I back Bernhard Anzeletti request. It's total unclear how to set up the server. In the configuration I have:

Applinks CORS Product Plugin - 5.0.3 Plugin byAtlassian

Enabled build: 10

But that is probably not for the REST API.

[CruzinUSA]

Hi Bernhard, 

This is a little late but if you're looking for our documentation on setting up CORS, you'll find it under the name Configuring The Whitelist.