Securing anonymous ticket creation

Srs
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
April 1, 2024

I have enabled anonymous users to create Jira tickets , the problem is that when some anonymous user create an issue with the Jira user's email address as the contact address, the Jira ticket shows Jira user as the reporter, which may be a security issue as jira user can be impersonated.

I don't want to disable anonymous users tickets as well. What are the recommended ways to secure anonymous ticket creations? 

1 answer

0 votes
Oday Rafeh
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
April 1, 2024

Hey Srs, welcome aboard!

Balancing anonymous reporting with security can be tricky. Here's how to tighten things up:

Stop Email Spoofing (Kind Of):

Jira can't magically block fake email addresses, but you can make it harder. Enable “Email Validation” during anonymous ticket creation. This ensures a proper email format (think [email address removed]) but doesn't guarantee it's real.

Consider CAPTCHAs (Optional):

Adding CAPTCHAs to the anonymous form throws a wrench into automated bots that might try to misuse the system.

Lock Down Anonymous Access:

By default, anonymous users have limited permissions. You can make things even tighter by:

Project Visibility: Only let anonymous users create tickets in projects with less sensitive data.
Field Permissions: Restrict which fields they can fill out in the ticket creation form.

 

Oday

Suggest an answer

Log in or Sign up to answer