Locking down the JIRA API - ramifications

[Taylor Huston]

Hi all,

Per the security requirements of the team I am working with, there can't be any kind of external API access. So far the best way to solve this, that I have came up with, is to block that at the Apache Proxy (different VM) level for anything that's an external IP. IE, I have this in my Apache Virtual Host:

<Location "/rest/api/2/" >
    Order Deny,Allow
    Deny from all
    Allow from 10.
</Location>

Initial testing looks good, but are there any ramifications I am not thinking of? Could it potentially break any Add-ons, for example?

[Nic Brough -Adaptavist-]

You will need to allow REST calls to all your users, or dashboards, gadgets and integrations will fail.

However, your security requirements are based on faulty understanding.  The REST API is simply a (slightly less functional) interface on to the web-ui.  There is no point in blocking it because everything you can do with REST can be done by a user with a browser.   REST respects the permissions and security that you set up for UI users.

Blocking REST provides you absolutely no security benefits, it just breaks stuff. 

[Taylor Huston]

Ugh wrong account

[Taylor Huston]

There is currently 2FA SAML in front of JIRA for the web-ui. Using the Rest API with Basic Auth bypasses that and that's a security no-go here. 

[Tzu Hau Chai]

Do you have any users that uses JIRA externally? I doubt you can do this unless all your user base only access JIRA internally, as there are rest api calls as well during normal usage.

[David Yu]

I believe sometimes the browser itself will make calls to /rest/api/2. For example, just loading the Rapid Boards I can see a request to /rest/api/2/project. 

Maybe you could inspect the referrer as most browser generated ones will have a value?

I guess this is good preventative measure to prevent users from integrating a cloud service without permission since most will operate via the rest api. Is that the main goal?

[Taylor Huston]

Wrong account

[Taylor Huston]

Yeah, but I THINK that can be avoided with the subnet rules. I am hoping that as long as I allow api calls from localhost, it should be fine. Hoping.

[David Yu]

That won't be enough as the requests will not be coming from localhost. They'll be coming from the end-user.

Somewhat related but you may also be interested in this:

https://community.atlassian.com/t5/Jira-questions/What-s-the-best-way-to-require-login-on-every-page/qaq-p/765834#M248511