Github deprecation of authentication via URL query params

Question

We’ve been getting notices like this recently from Github:

On February 28th, 2021 at 07:23 (UTC) your application (JIRA) used an access token (with the User-Agent Apache-HttpClient/4.5.13 (Java/1.8.0_275)) as part of a query parameter to access an endpoint through the GitHub API.
https://api.github.com/repositories/343041599/hooks
Please use the Authorization HTTP header instead as using the `access_token` query parameter is deprecated.
Depending on your API usage, we'll be sending you this email reminder on a monthly basis.
Visit https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param for more information about suggested workarounds and removal dates.

Does this have something to do with a github integration in JIRA? Has anyone else seen this before? Looking to solve this before

* May 5, 2021 at 16:00 UTC

Andy Heinzer · Accepted Answer

Hi @John-Pierre Atallah

We are aware of these kinds of warning messages sent from GitHub. The way to resolve this problem though is different depending on what platform of Jira you are using (Server or Data Center VS Jira Cloud).

If you're using Jira Server or Jira Data Center:

Most commonly these have been seen in Jira Server/Data Center installations that have previously setup an integration between Jira and GitHub using our DVCS connector.  There is a bug ticket about this from Jira Software side over in JSWSERVER-20414.

This is something we have changed in Jira server with 8.12.0 and all versions higher.  I would recommend upgrading Jira in order to get this fix that then allows you to setup this integration without the access_token query parameter.

If you are using Jira Cloud:

It is still possible that you might see this message if you are using Jira Cloud, but obviously you cannot upgrade your version to fix this problem like you can on Server/Data Center. This is largely because Atlassian deprecated support for our DVCS connector in Cloud back in 2018 (see this blog post about it).  This deprecation though does not necessarily remove existing integrations.  If this applies to you, then as a site-admin of a Cloud site, you should still be able to go to your Cloud site Gear icon -> Products -> DVCS account (or you can use the URL of https://[yourCloudName].atlassian.net/secure/admin/ConfigureDvcsOrganizations!default.jspa ).   This DVCS accounts page can still work with GitHub Enterprise editions, but otherwise, you will likely want to remove an GitHub repos listed here.  By removing the GitHub integrations on this page, that will prevent GitHub from sending these kinds of warning emails if Jira is responsible for it.

Once you have done that though, you probably still want the same functionality of that prior integration.  In place of using the DVCS in Jira Cloud, we instead recommend GitHub's own Jira Cloud app for integrating Jira Cloud with GitHub.

I hope this helps to explain why this happens, and how to resolve this.

Let me know if you have any questions or concerns about this.

Andy