CORS: Backend programming or frontend programming? which one to choose for creating issue using Rest

[Mahesh Sherkar]

Hi,

I’m new to Jira. I want to create issue in Jira Cloud(hosted in AWS) site using rest Post api from Angular8 site(frontend programming) but Im getting CORS error.

Error:-
“Access to XMLHttpRequest at ‘https://mysite.atlassian.net/rest/api/2/issue’ from origin ‘https://ABCD.sharepoint.com/’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.”

Question:-
I’ve whitelisted my sharepoint site in Jira cloud site still i’m getting above CORS error. I gone through many articles but nothing works.
Is it possible to resolve above error using frontend programming like Angular8 Or Shall i use backend programming like node.js etc because its crossdomain call?

Your help with this would be greatly appreciated.

Thanks,
Mahesh S

[Mehmet A _Bloompeak_]

Hi @Mahesh Sherkar ,

It is not possible to fix it on the client side. Solution would be to add "Access-Control-Allow-Origin" to the response coming from the https://mysite.atlassian.net.

I understand that the Jira server is under your control in AWS. According to your AWS setup(on LB or on Ec2), you should add one the below headers to fix it.

Access-Control-Allow-Origin: *

Access-Control-Allow-Origin: ABCD.sharepoint.com

 Apart from all of the above, I want to highlight possible security gap on your calling a jira rest api from the client side. The rest api must require authentication to create issue. Do you pass the credentials of rest api on the client side?

[Mahesh Sherkar]

Bloompeak Support:-

Yes, Im using Basic authentication and im passing username:password in encoded form in the header.

[Mehmet A _Bloompeak_]

It means that you store the credentials on the client side. Be aware that end user can see the credentials from the browser.

[Mahesh Sherkar]

Actually this functionality has access to limited people(probably 1 or 2 person)  and im passing that username:password in encoded format from backend(Sharepoint list/table) through the varible. Not directly  writing down in code.

Is there any otherway because I dont have access on Jira Cloud (AWS jira site) to do the modification to  add "Access-Control-Allow-Origin" setting as you explained above?

[Mehmet A _Bloompeak_]

The other solution is to call the jira rest api from your sharepoint backend.