Not able to request Jira’s API from a front-end javascript page - CORS

[Jeremy Octeau]

Hey!

I'm trying to access the Jira's API from an Angular web page but I'm always getting this error: 

Access to XMLHttpRequest at 'https://company.atlassian.net/rest/api/latest/agile/1.0/board?max_results=50' from origin 'https://company.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I read multiple forum threads but I can't find the whitelist option in the Jira administration panel.
How can I fix this issue?
Knowing that my company is using Jira Software (Cloud)

Thank's,
Jeremy

[Dario B]

Hi @Jeremy Octeau ,

Welcome to the Atlassian Community!

CORS are only supported using OAuth 2.0 (3LO) for apps, while from your URL I can see that you are not using that.

So, in your case, you may want to use something like CORS anywhere to proxy your calls.

For further details on this please see: 

• https://community.developer.atlassian.com/t/cors-error-with-rest-api/27354/4

We actually do support CORS requests when using https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/, as your requests will go through api.atlassian.com where token based authentication is the only thing we allow.

For further explanation: The problem why we don’t support CORS directly on your site host/domain is that we accept session based authentication on there, which would then allow any site to make random, authenticated requests to your site.

The alternative is to proxy your requests through your own backend

Cheers,
Dario

[Jeremy Octeau]

Hey @Dario B ,

So I followed the different steps of the documentation you sent me.
I was able to get a code from the OAuth 2.0 (3LO) and then transform it into an access_token by using  POST https://auth.atlassian.com/oauth/token .

I retrieved all the accessible resources with GET /oauth/token/accessible-resources 
and it looks like it's working.

Just one issue: for example when I request

https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/latest/dashboard/search?dashboardName=test&max_results=50

I receive an error: OAuth 2.0 is not enabled for this method.


But when using 

https://api.atlassian.com/ex/jira/{cloud_id}/rest/api/2/dashboard/search?dashboardName=test&max_results=50

It looks like it's working. Am I missing something?

Also, is there a way of getting all the values for the sprints? Which is technically customfield_10020 in my case?

[Dario B]

Hello @Jeremy Octeau ,

You are not missing anything, you have just hit the below bug:

• [JRACLOUD-72126] Using "latest" in REST API endpoints returns OAuth 2.0 is not enabled for this method

As you can see the bug has been closed 2 days ago since it didn't get enough traction so far and since it has a very simple workaround: just use either 2 or 3 in REST API endpoints you are calling, do not use "latest".

Please let me know if I should ping the dev team in charge of fixing this bug to ask to have it re-opened.

Also, as regarding a way to get all the values for the sprints, this can be done by using the Jira Software Cloud REST API endpoint: 

• Get all sprints GET /rest/agile/1.0/board/{boardId}/sprint

If this is not what you were looking for please provide more details.

Cheers,
Dario

[Vlad Nik]

Hello @Dario B 

What could be the reason that I get an error ("OAuth 2.0 is not enabled for this method.") when trying to get sprints with this and other endpoints?

https://api.atlassian.com/ex/jira/dfdda614-3aae-48b5-a0cf-ee3cc4032b4e/rest/agile/1.0/board/filter/10200 

https://api.atlassian.com/ex/jira/dfdda614-3aae-48b5-a0cf-ee3cc4032b4e/rest/agile/1.0/board/1000/sprint

https://api.atlassian.com/ex/jira/dfdda614-3aae-48b5-a0cf-ee3cc4032b4e/rest/greenhopper/latest/sprint/picker

We use Oauth 2 (3LO)

Thanks

[Dario B]

Hello @Vlad Nik ,

As the error message says, it is really the case that Oauth2 is not enabled for those REST API endpoints.

Indeed, if you look at the documentation for the Board REST API endpoints, you can see that there is no Oauth scope declared in there:

• https://developer.atlassian.com/cloud/jira/software/rest/api-group-board/#api-group-board

For this reason I have created below feature request some time ago, asking to have Oauth2 enabled also for all the Jira Software Cloud REST API endpoints:

• [JSWCLOUD-18874] OAuth 2.0 for all the JSW REST API endpoints 

You may want to vote and watch the above feature request so that you will get notified in case of any update. The  feature will be addressed according to the Implementation of New Features Policy.

Cheers,
Dario

[Vlad Nik]

Thanks, @Dario B 

[Dario B]

You are very welcome @Vlad Nik , Have a nice weekend! :)