-
Suggestion
-
Resolution: Unresolved
-
None
-
None
-
1
-
Problem Definition
Since Jira 8.14 users have the ability to generate personal access tokens as an alternative to authenticate to Jira.
These tokens are base64 encoded of byte arrays without any predefined pattern.
Having a pattern, such as a known prefix, would be of great help for security scanners to identify when a token is hardcoded in code repositories.
Suggested Solution
Add the ability to configure a prefix for any generated token.
For example, if a generated token looks like NTQ3NTQ0OTcwNTk4Oni132JJ/DUDz78U+PliwQt3rQFK with today's configuration, it could be as JIRA-NTQ3NTQ0OTcwNTk4Oni132JJ/DUDz78U+PliwQt3rQFK with a JIRA- prefix, making it easier for security scanners to identify it.
The prefix should be configurable so that each administrator can adjust the prefix on their instances.