Getting 403 - Permission Denied through Jira REST API POST request.

[Dustin]

I'm trying to make a post request to perform a transition (transition issue to Done), but it keeps giving me a 403 error. I don't think this is a permissions error (ironically), as I am able to make GET requests with the same Auth info, and I can make the exact POST request via CURL just fine. What is it about making the POST request through AJAX that causes the 403?

[Thomas Deiler]

Dear @Dustin,

can you please post the JSON errorMessage?

So long

Thomas

[Dustin]

{
  "readyState":4,
  "responseText":"XSRF check failed",
  "status":403,
  "statusText":"error" 
}

[Dustin]

@Thomas Deiler ^^

[Thomas Deiler]

Dear @Dustin,

you have to add headers:

"Content-Type", "application/json"

"accept", "application/json"

"X-Atlassian-Token", "nocheck"

So long

Thomas

[Dustin]

Hey @Thomas Deiler, I tried those headers, still getting same response. According to this article: https://confluence.atlassian.com/cloudkb/xsrf-check-failed-when-calling-cloud-apis-826874382.html, you can't make XSRF protected requests through the browser. Do you think that's the case here?

[Thomas Deiler]

Dear @Dustin,

the article describes exactly the case with the REST Api. They just add the third header and leave the others away. Can you check this?

So long

Thomas

[Dustin]

Note that this is only available for requests made by command line tools
or external systems, not browser requests. This is because the
Cross Origin Resource Sharing specification does not allow JavaScript 
loaded in third party websites to set arbitrary request headers.

So this only helps for CURL, not Javascript code? Because it does work with curl. Or am I missing something @Thomas Deiler

[Thomas Deiler]

Dear @Dustin,

this has nothing to do with curl or anything else. Regardless with which library you communicate with the REST API, you have to follow the rules of the API - that's same for all. Otherwise it wouldn't be an API.

So long

Thomas

[Thomas Deiler]

Dear @Dustin,

have you been successful meanwhile?

So long

Thomas

[zzw8200465323]

I also encountered the same problem@Thomas Deiler 

[zzw8200465323]

const httpClient = await addon.httpClient({ addon: addon, clientKey: '5d5659b6-09f0-3482-bfa2-0405c4818f1e' }); 
httpClient.del({ url: 'rest/api/3/project/10002', 
headers: { 
'Accept': 'application/json', 
'Content-Type': 'application/json', 
'X-Atlassian-Token': 'nocheck' } }, 
(err, response, body) => 
{ res.send(`body = ${body}`);  });
//403

 @Thomas Deiler  

The same, I can get data using get request

const httpClient = await addon.httpClient({ addon: addon, clientKey: '5d5659b6-09f0-3482-bfa2-0405c4818f1e' }); 
httpClient.get('rest/api/3/mypermissions', function (err, response, body) { res.send(`body = ${body}`); });
//success

[Brandon Miller]

Any updates on this one? I'm running into the same thing. I'm able to get my POSTs working v ia Postman, but I'm trying to create a Microsoft Flow connector and it keeps throwing the XSRF check failed error

[Thomas Deiler]

Dear @Brandon Miller  and @zzw8200465323 ,

can you please post the JSON dump that is sent to Jira, that is causing the problems?

So long

Thomas

[zzw8200465323]

hi 

@Thomas Deiler 

@Brandon Miller 

This problem has been solved

https://community.atlassian.com/t5/Jira-questions/node-express-Jira-403-error/qaq-p/1103558?utm_campaign=accept_as_solution_reminder&utm_content=view-answer&utm_medium=email&utm_source=atlcomm#M352121

[zzw8200465323]

@Thomas Deiler     and   @Brandon Miller 

This question is resolved

https://community.atlassian.com/t5/Jira-questions/node-express-Jira-403-error/qaq-p/1103558?utm_campaign=accept_as_solution_reminder&utm_content=view-answer&utm_medium=email&utm_source=atlcomm#M352121

[Thomas Deiler]

@zzw8200465323 good! With your link information the question seems to be answered. Can you mark it?

Thanks

Thomas