Turning off Form Token Checking

[Sreenivasaraju P]

hi,

I am planning to disable token checking using jira.xsrf.enabled=false

as mentioned,@https://confluence.atlassian.com/display/JIRA043/Form+Token+Handling

Will this lead to any security issues or vulnerabilities?

[MatthewC]

You need to look at it in terms of your risk/reward profile. What's your user base, is it small & trusted group or large & public. Is the information valuable? What would happen if it was stolen?

and what's the reason for turning it off? Is it worth the extra risk. Atlassian put this code there for a reason. Is there another way around this? Are you trying to use Jira in a way that it shouldn't be used?

[Joel]

In terms of larger enterprise installations with oversight on security measures this really isn't feasible. Atlassian should focus on fixing the actual bug.

[AhmadDanial]

Hey there, Prathighantam.

As far as I am concerned, the security issue that you will need to be concerned of is the fact that your JIRA instance will be vulnerable to XSRF (https://en.wikipedia.org/wiki/Cross-site_request_forgery) attacks. This prevent users being tricked into unintentionally submitting malicious data. Apart from that, I am not sure what other security issues is posed after you disable it.

Warm regards,

Danial

[Joel]

This is concerning. We're turning off security measures to work around bugs? Our enterprise security office will not get behind this measure. Can we get an actual fix for this?