Turning off Form Token Checking

Sreenivasaraju P
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 27, 2013

hi,

I am planning to disable token checking using jira.xsrf.enabled=false

as mentioned,@https://confluence.atlassian.com/display/JIRA043/Form+Token+Handling

Will this lead to any security issues or vulnerabilities?

2 answers

0 votes
MatthewC
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
May 27, 2013

You need to look at it in terms of your risk/reward profile. What's your user base, is it small & trusted group or large & public. Is the information valuable? What would happen if it was stolen?

and what's the reason for turning it off? Is it worth the extra risk. Atlassian put this code there for a reason. Is there another way around this? Are you trying to use Jira in a way that it shouldn't be used?

Joel April 2, 2020

In terms of larger enterprise installations with oversight on security measures this really isn't feasible. Atlassian should focus on fixing the actual bug.

0 votes
AhmadDanial
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
May 27, 2013

Hey there, Prathighantam.

As far as I am concerned, the security issue that you will need to be concerned of is the fact that your JIRA instance will be vulnerable to XSRF (https://en.wikipedia.org/wiki/Cross-site_request_forgery) attacks. This prevent users being tricked into unintentionally submitting malicious data. Apart from that, I am not sure what other security issues is posed after you disable it.

Warm regards,

Danial

Joel April 2, 2020

This is concerning. We're turning off security measures to work around bugs? Our enterprise security office will not get behind this measure. Can we get an actual fix for this?

Like # people like this

Suggest an answer

Log in or Sign up to answer