Jira session gets instantly destroyed

[Connect]

We recently upgraded from Jira 9.12.15 LTS to Jira Data Center 10.3.2 and immediately noticed some issues which did not happen previous to the upgrade.

We are running a few tests that require basic authentication through the rest api.

After authenticating for the first time, we are storing locally the cookie with the JSESSION and the xsrf token.

When trying to make new requests with that cookie, we get response code 401 Unauthorized.

Upon checking the logs of the jira instance we noticed that in the span of a few milliseconds, the session is destroyed, hence why we get Unauthorized on the next request.

It's worth noting that previous to this upgrade, this mechanism was working perfectly fine, nothing has changed with it in a very long time.

[David Bakkers · Accepted solution]

I think this was part of the improvement to the security of v10.2

AFAIK, to prevent potential session hijacking, the ability to generate permanent user Session Cookies by triggering a Basic auth session inside a web browser has been removed. You must now use the method of providing the user's encoded key+token credentials with every single request, which is really the proper implementation of Basic auth.

Also, because a Basic auth connection inside a web browser is not a two step authentication method, that would contradict the corresponding enforceable login security policy feature introduced in v10.2.

[Connect]

Thanks a lot for the tip @David Bakkers . Looks like I missed that particular change in the changelog. In case someone else gets blocked by this, -Datlassian.authentication.legacy.mode=true switches back the authentication to the old behavior.