Having the same issue in Jira Server

Facing the same issue while calling an endpoint `/projects` with an invalid username/service account.

Having the same issue. 

Having the same issue on Jira Server

Has there been an update to correcting the problem on either Crowd or Jira side?

Hey alexander.weickmann!

We have an idea of what's happening and are tackling the issue on the Crowd's side at the moment.

There's a race condition that can cause concurrent Basic Auth requests to fail with a 500 error. Our Crowd engineers are working on changing the way we handle the Basic Auth requests to fix this. A workaround, for now, would be to use OAuth based requests.

Then, on the Jira's side, we do not handle the 500 error from Crowd correctly. We set the error header, but do not change the response code, which results in an empty 200 response. Unfortunately, a fix is not straightforward, because the response object passes so many levels of abstraction. Thus, we are focusing on fixing the root cause (handling of Basic Auth requests) for now, without prioritizing this bug in Jira.

I hope this answers some of your questions.

Any news on this from official side? Running into this when performing Gatling performance tests (about 10% of requests fail due to this).

Haven't seen this listed so I'll post it in case it helps someone:

I was having this same problem (200 status, no response body, AUTH_FAILED).

Local Jira server. 

When we create accounts, we leave the password blank and it authenticates to active directory.

I was using my active directory account the whole time. As soon as I created a local account that wasn't in AD (with a password) it worked fine.

Finally I fixed this issue. Definitely a bug on their part. What's happening here is that they're using CSRF/XSRF protection on the endpoint. What does this mean for you?

Essentially you need to create a session before you can make a request. Here's my code using Node JS and the request module:

Sorry if it's messy. The important part is the request.jar() method, which creates a session called cookieJar. This cookieJar object is then passed with each request, ensuring the CSRF token is passed with each response.

var request = require('request');/* GET home page. */
router.get('/', function(req, res, next) {
{{ var cookieJar = request.jar();}}var options = { method: 'GET',
{{ url: 'https:/test.atlassian.net/wiki/rest/api/content',}}
{{ jar: cookieJar,}}
{{ qs:}}
{{ { type: 'page',}}
{{ title: 'title' },}}
{{ headers:}}
{{ {'cache-control': 'no-cache',}}
{{ authorization: 'Basic yourEncodedAuthHere } };}}request(options, function (error, response, body) {
{{ if (error) throw new Error(error);}}
{{ request(options, function (error, response, body) {}}
{{ if (error) throw new Error(error);}}
{{ console.log(body);}}
{{ });}}
{{ });}}res.send('hello');
});

I, too, am getting this.  PHP 5.3 using Curl (using the "@" method.