Misleading 200 status code when using incorrect credentials in REST API calls

XMLWordPrintable

    • 9
    • 19

      Issue Summary

      if you call the Jira Cloud REST API endpoints with wrong credentials you get status 200 (OK) with empty response.

      Steps to Reproduce

      curl -u user:WRONGTOKEN -X GET "https://<your site name>.atlassian.net/rest/api/3/issue/createmeta"

      Observe 200 in response instead of 401:

      {"expand":"projects","projects":[]}

      Expected Results

      Response with 401 status code

      Actual Results

      Response with 200 status code

      Workaround

      If you expand the headers you can see that the authentication failed:

      curl -D- -u user:WRONGTOKEN -X GET "https://<your site name>.atlassian.net/rest/api/3/issue/createmeta"

HTTP/2 200 
date: Thu, 16 Nov 2023 11:11:56 GMT
[..removed..]
x-seraph-loginreason: AUTHENTICATED_FAILED
[...removed...]
atl-traceid: 5ca64d54a9a44c7fb3f7498588389e9a
[...]

{"expand":"projects","projects":[]}

       

       

            Assignee:
            Unassigned
            Reporter:
            Dario B
            Votes:
            2 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated: