Restrict Access to Jira Cloud Rest End Points

[Tulika]

Hi,

I want to know, if there is a way we can restrict access to certain JIRA rest endpoint in case of JIRA Cloud.

I want to restrict access to anonymous end point like <BaseURL>/rest/api/3/field

I also want to restrict access to the project fetch end point <BaseURL>/rest/api/3/project/search

Thanks and Regards,

Tulika

[Gerusa Lobo _e-Core_]

Hi @Tulika 

All endpoints in Jira Cloud needs a user authentication.

Some pluggins hide the authentication because use its add-ons users.

The information access and endpoints available are based on access and permission of the user in a projects.

If the user don't have access in a project he won't get any information for this project or execute anything.

Also, in Authentication Policies at Organization is possible to disable the access to API for all users in a policy.

Regards.

[Tomislav Tobijas]

Hi @Tulika ,

As far as I know, you cannot restrict REST API calls and endpoints. There's a feature suggestion related to restrictions: JRACLOUD-42122: REST API Access Permission 

But API calls should respect user permissions. Meaning, if your Jira doesn't have anonymous access enabled on specific projects, 'external' people who don't have access to your site should not be able to use the mentioned endpoints and would probably get unauthorized message.

Now, I haven't been playing that much with REST APIs that I can stand 100% behind this 👀

Cheers,
Tobi

[Tulika]

Hi Tomislav,

We know about the project specific restrictions but we want to know if there is a option in jira using which we can block access to certain anonymous access endpoints like - <BaseURL>/rest/api/3/field

Cheers,
Tulika

[Tomislav Tobijas]

Oh, I see. I just tried using some endpoints on hello.atlassian.net and it provided responses without any authorization. Wow...

I'm not sure if whitelisting would help here 👀

But I agree that this could provide security risks in some cases. I would suggest reaching out to Atlassian Support and discussing it further with them. I've tried checking JAC for any open suggestions on that topic, but I couldn't find any :/

[Gerusa Lobo _e-Core_]

Hello @Tulika @Tomislav Tobijas 

As I know, all API endpoints in Atlassian need a authentication.

https://developer.atlassian.com/cloud/jira/software/basic-auth-for-rest-apis/

I don't know any Atlassian endpoint that is not required the authentication to run with success.

If you put a endpoint in a browser, you are still using the authentication using a cookie of the SSO saved on cache of the browser.

I suggest you try to proceed a get using a postman or curl without authentication to try get information from these endpoints.

Regards.

[Tomislav Tobijas]

@Gerusa Lobo _e-Core_ well, I tried using Postman and thus why my previous comment.

No auth on site name/base URL combined with /rest/api/latest/field and you'll get the response.

However, it's worth noting that this seems to get system fields/info which is the same on all sites (it won't reveal any custom fields you're using).
Still, IMO, this shouldn't give a response if you're not using auth.