The only REST resources that will permit access are those that are meant for anonymous access as well or that perform their own security checks. These have to be explicitly marked with
@AnonymousAllowed or they will automatically reject any anonymous request.
The ability for anonymous users to reach those REST APIs that explicitly mark themselves in this way is very important. Some REST APIs are accessible to anonymous users if and only if you have enabled a permission scheme that permits this (for example, projects that can be browsed anonymously) or because logging in can itself be a request to the REST API, specifically this one, and disallowing that would make things like JIRA Mobile unusable.
If you want to make sure your projects are not visible to anonymous users by default, then you should check that your permission schemes are correct. Blocking REST API access is the wrong way to tackle that problem.
I'm had project to create third party application that access JIRA api. Actually i want application have token(or basic auth) that can access all Rest API. But disabled all anonymous access to API.
If you think set schema permission. I will check this approach. But i prefer a configuration to block all rest if anonymous try access api.
But if you block all anonymous REST API access, it will probably break JIRA. The REST API is designed to take care of authentication itself. Besides, your third-party application will need to use an anonymous REST endpoint to get an authentication token in the first place.
We just failed a security scan because anonymous requests to the REST API allow a malicious user to enumerate valid JIRA 7.3.2 accounts, for example:
Is there a way to disable this by requiring authentication?
Hey Community mates! Claire here from the Software Product Marketing team. We all know software development changes rapidly, and it's often tough to keep up. But from our research, we've found the h...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs