Uploaded image for project: 'Jira Platform Cloud'
  1. Jira Platform Cloud
  2. JRACLOUD-65573

CORS not supported in JIRA Cloud REST API but not mentioned in documentation

XMLWordPrintable

      Summary

      According to https://docs.atlassian.com/jira/REST/cloud/ ...

      Note, JIRA itself uses cookie-based authentication in the browser, so you can call REST from Javascript on the page and rely on the authentication that the browser has established. To reproduce the behavior of the JIRA log-in page (for example, to display authentication error messages to users) can POST to the /auth/1/session resource.

      It is mentioned in documentation that Javascripts can be used to fire REST Calls to Cloud instances but in truth this is wrong because attempting to fire REST Calls from Javascripts will return errors regarding CORS.

      No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 401.

      Will be best to keep this portion updated so that it doesn't confuse users.

            [JRACLOUD-65573] CORS not supported in JIRA Cloud REST API but not mentioned in documentation

            Krzysztof Kercz added a comment -

            The documentation has been updated. Closing the issue.

            Let me also leave this here as an explanation of why CORS is not available:

            We actually do support CORS requests when using https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/, as your requests will go through api.atlassian.com where token based authentication is the only thing we allow.

            For further explanation: The problem why we don’t support CORS directly on your site host/domain is that we accept session based authentication on there, which would then allow any site to make random, authenticated requests to your site.

            The alternative is to proxy your requests through your own backend

            Source: https://community.developer.atlassian.com/t/cors-error-with-rest-api/27354/4

            Krzysztof Kercz added a comment - The documentation has been updated. Closing the issue. Let me also leave this here as an explanation of why CORS is not available: We actually do support CORS requests when using https://developer.atlassian.com/cloud/jira/platform/oauth-2-authorization-code-grants-3lo-for-apps/ , as your requests will go through api.atlassian.com where token based authentication is the only thing we allow. For further explanation: The problem why we don’t support CORS directly on your site host/domain is that we accept session based authentication on there, which would then allow any site to make random, authenticated requests to your site. The alternative is to proxy your requests through your own backend Source: https://community.developer.atlassian.com/t/cors-error-with-rest-api/27354/4

            Enkhtaivan Ganbat added a comment -

            Got same error while trying to access Jira Cloud REST API from javascript

            Enkhtaivan Ganbat added a comment - Got same error while trying to access Jira Cloud REST API from javascript

              istankiewicz Eve (Inactive)
              vchin Vincent Chin (Inactive)
              Affected customers:
              6 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: