How to access WebSudoAuthenticate with JIRA 9

[Gaël NEUEZ]

Hello

we are using python to do some admin operations on our JIRA server.

To perform these operarations, we need to get websudo first, before we can call the admin rest points.

This is working very fine with our 8.20.9 version; but now we're testing the upgrade to JIRA 9.4.12, and it seems it's not working anymore.

Basically what we do:

session = requests.Session()
json_data = {"WebSudoIsPost": "false", "authenticate": "Confirm"}

response = session.post(https://ourjira/secure/admin/WebSudoAuthenticate.jspa,
                           auth = (adm_name, adm_password),
                           verify = False,
                           headers = ({'Accept': 'application/json', 'Content-Type': 'application/json'}),
                           json = json_data)

With JIRA8, the response code is 200 (normal...)

With JIRA9, the response code is now 403. 

I tried with fresh new installs of JIRA8/9, same behavior.

Now, looking at the logs of jira9, i can see this error:

XSRF checks failed for action 'com.atlassian.jira.web.action.admin.WebSudoAuthenticate!execute'

I assume i need to add more params to my request header or json data, but not sure what...

Any help appreciated !

[Gaël NEUEZ]

OK, it looks like adding the 

, 'X-Atlassian-Token': 'no-check'

parameter to my headers seems to do the trick. However if someone has a more robust/secure way to do it, I'm all ears...