Support for (mTLS) Authentication in Jira Forge Apps for Web Triggers and External API Calls

XMLWordPrintable

      Issue Summary:
      Jira Forge apps currently do not support mutual TLS (mTLS) authentication for incoming web triggers nor for outbound API calls to external systems requiring mTLS. This limits secure integrations with external systems that mandate mTLS for authentication and authorization.

      Steps to Reproduce:

      1. Create a Forge app that publishes a web trigger to receive incoming HTTPS requests.
      1. Attempt to configure the external system to connect to the web trigger endpoint using mTLS client certificates.
      1. Attempt to configure the Forge app to call an external API that requires mTLS client authentication.

      Actual Result:

      • Incoming requests to Forge web triggers cannot be authenticated via mTLS as Forge does not support client certificate validation on incoming connections.
      • Forge apps cannot perform mTLS authentication when invoking external APIs because the Forge runtime environment does not support managing TLS client certificates.

      Expected Result:

      Forge apps should support mutual TLS authentication for incoming web triggers, allowing the external system to securely authenticate with client certificates.
      Forge apps should be able to perform mTLS when making outbound API requests to external systems that require client certificate authentication.
      This would enable secure, enterprise-grade integrations where mTLS is a compliance or security requirement.
      

            Assignee:
            Unassigned
            Reporter:
            Yuvie Naidoo (Inactive)
            Votes:
            9 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated: