Jira Server 8.0.2 REST API. Unauthenticated users visable

[Randomized J]

I have a question about the REST APT and how I can change it.

This is the issue.. When I check authenticateion at:
.../rest/auth/1/session

it returns what I expect:
{"errorMessages":["You are not authenticated. Authentication required to perform this operation."],"errors":{}}

However when I go to:
.../rest/api/2/user/search?includeInactive=true&username=.&startAt=0&maxResults=2000

I get a result listing all the users

But when I try to goto the url
.../rest/api/2/user?username=user1

again I get the error I should:
{"errorMessages":["You are not authenticated. Authentication required to perform this operation."],"errors":{}}

How do i fix the user search so it requires authentication?

[Randomized J · Accepted solution]

The behavior you currently reported is a known bug on Jira, that is detailed on JRASERVER-68815, which is restricted to Atlassian staff due to security concerns involved on this request.

This has been resolved on the following versions:

• 7.13.3
• 8.0.4
• 8.1.1
• 8.2.0

[Petr Vaníček]

Hi,

I just tried it in incognito mode with our TEST env running on 8.0.2 and it return empty brackets. Can you double check it?

[Randomized J]

We have 2 environments also. I have gotten a person who doesn't have an account on our test environment to test.

They get the same results.

Not authenticated @ .../rest/auth/1/session

Full list of people @ .../rest/api/2/user/search?...

Not autheenticated @ .../rest/api/2/user?username=user1

We have had Jira for a long time. Our oldest closed ticket is from 2007, So, its possible there could be some legacy thing from an older version of Jira that is causing it. 

[Petr Vaníček]

So in that case try to contact Atlassian Support directly if they find where is problem

https://support.atlassian.com/contact/#/

And let me know, I'm interested :-)

[Randomized J]

The behavior you currently reported is a known bug on Jira, that is detailed on JRASERVER-68815, which is restricted to Atlassian staff due to security concerns involved on this request.

This has been resolved on the following versions:

• 7.13.3
• 8.0.4
• 8.1.1
• 8.2.0