How to use jQuery in Confluence to run a JIRA REST query without hard-coding username/password in plain-text?

[Phillip Ponzer [Cprime]]

The only way I am currently able to run jQuery to query JIRA via REST across domains is by hard-coding my username and password in the request's URL:

$(document).ready(function(){
    $.getJSON("<JIRA URL>/rest/api/latest/issue/ISSUE-123?os_username=<username>&os_password=<password>", function(data) {
        $("body").html(JSON.stringify(data));
    });
});

Is it possible to query JIRA over REST in a different domain without hard-coding my username/password in plain-text?

UPDATE:

I probably should have mentioned that I'm doing this within a Confluence User Macro on a Confluence server that has an application link with my JIRA server. I'd think somehow utilizing the application link might be a possible solution?

[Phillip Ponzer [Cprime] · Accepted solution]

Through much reverse-engineering, I was able to find a way to query JIRA from with a Confluence User Macro using jQuery utilizing the application link between Confluence and JIRA.

Here's what I came up with:

1. Run the following REST query on the Confluence server to obtain JIRA's UUID (universal unique identifier):
   

   <Confluence URL>/rest/jiraanywhere/1.0/servers

   Which returns:

   [
     {
       id: "2c66970e-35f8-365f-bc65-f535d7edf1a1",
       name: "JIRA",
       selected: true,
       url: "<JIRA URL>"
     }
   ]

2. Copy the "id" value, this is the UUID.
3. Plug that value from #2 into a standard ajax call using jQuery:
   

   jQuery.ajax({
     type: "GET",
     url: "<Confluence URL>/plugins/servlet/applinks/proxy?appId=<UUID>&path=<JIRA URL>/rest/api/latest/issue/ISSUE-123",
     dataType: "json",
     async: false,
     success: function( data ) {
         alert( data.key );
     }
   });

[MB]

Well, if you are using an atlassian gadget within an atlassian gadget container (which confluence provides), then of course your gadget is already authenticated itself, prior to that ajax call (search for "useOAuth" in the gadget's code). I was convinced that you are talking about a standalone javascript on a third party server (because you mentioned jquery instead of AJS) :)

Glad you solved it :) Cheers :)

[Phillip Ponzer [Cprime]]

My apologies, I updated the issue to reflect it after you had started commenting on my question and I had realized my mistake.

I'm not modifying any gadget, nor am I creating my own. I'm creating a User Macro to be used in a Confluence page. Are you saying there's an even easier way to do this than what I've found in my solution (without creating my own proxy)?

[Ismar_Slomic]

Thank you, thank you, thank you! This post should be documented in the official Atlassian documentation. I have used 3 days to find this information.

[Davin Studer]

It should be noted that the "path" should be URL encoded. So take your normal JIRA rest call and run that through a url encoder first. Now it is quite possible that your original rest call might have some stuff that is url encoded as well ... so those portions will end up getting double url encoded.

[Davin Studer]

Also, thanks a ton. This also gets around any CORS issues.

[F. Javier Mesa]

Hello @Davin Studer, did you use the suggested REST call by that date?

"<Confluence URL>/plugins/servlet/applinks/proxy?appId=<UUID>&path=<JIRA URL>/rest/api/latest/issue/ISSUE-123"

I'm trying mine:

https://fxmesas.atlassian.net/plugins/servlet/applinks/proxy?appId=ff0f74d4-21d9-3fe2-a230-9210e221404a&path=https%3A%2F%2F16836ccf.ngrok.io%2Frest%2Fapi%2F1.0%2Fprojects%2FBBTES%2Frepos%2Ftrainers%2Fbranches

and I get 404 -> not found. Did that end point exist for you?

I am trying to leverage one app linked (bitbucket server) to my JIRA to make a rest call to bitbucket public REST API, so something similar to @Phillip Ponzer [Cprime] 's case.

[Davin Studer]

I made the call from a Confluence server. Not sure if the applink proxy exists in Bitbucket or if it does if that is the correct URL.

[csolyom]

Did you manage to use this to create a JIRA issue as well?

For me the 'GET' calls are working as you described,

 $.ajax({
 url: '<CONFLUENCE URL>/plugins/servlet/applinks/proxy?appId=<APP_ID>&path=<JIRA_URL_ENCODED>%2Frest%2Fapi%2F2%2Fissue%2FISSUE-123',
 type: 'get',
 contentType: 'application/json',
 success: function (resp) { },
 });

 but the 'POST' requests always fail with HTTP 400 Bad request: "The request sent by the client was syntactically incorrect"

var jiraData = {"fields": {"project": { "key": "PRJ" },"summary": "dummy","description": "test","issuetype": { "name": "Task" }}} 

$.ajax({
 url: '<CONFLUENCE URL>/plugins/servlet/applinks/proxy?appId=<APP_ID>&path=<JIRA_URL_ENCODED>%2Frest%2Fapi%2F2%2Fissue',
 type: 'post',
 contentType: 'application/json',
 data: JSON.stringify( jiraData ),
 success: function (resp) { },
 });

I am thinking that the JSON should be formatted/escaped somehow.. any clue?

I use:  JIRA v7.2.7, Confluence 6.4.3

[Abhijit Sipani]

Did you ever figure out how to get around the POST issue? I am hitting the same when trying to do a POST/PUT.

[MB]

If you are creating an independent html code, on a 3rd party website, that will access your JIRA, which ever way you decide to go, don't put any user credentials/private keys inside javascript code.

The way JIRA does this in the gadgets is by providing an automatic authorization using OAuth like this:

useOauth: "/rest/gadget/1.0/currentUser"

but since gadget, the gadget container and JIRA are all located physically on the same machine, the authentication is not a big deal.

But, if you are using the standalone html page, that wants to authorize itself to JIRA, you'll most probably need to either use a "proxy" script, implemented on your secure server, which will contain your user credentials, so that javascript accesses your script, which actually authenticates itself to your JIRA and forwards further REST requests from javascript code or you'll have to use public REST services, which don't require authentication.

One additional method is to use either basic auth or OAuth and provide a user with a popup dialog to provide the needed credentials the first time you access the JIRA REST services. But you'll have to persist those credentials either in cookies or in the session or some other way.

[Phillip Ponzer [Cprime]]

By "proxy" script do you mean host a "js" file on my JIRA server which holds my credentials and include it in my standalone HTML page?

<script src="<JIRA URL>/credentials.js" type="text/javascript"></script>

[MB]

No. If you put your credentials into a javascript file and make it downloadable to users, you practically gave them access to your JIRA.

What I meant by "proxy" was to implement java servlet (or server-side php script) page which your javascript code will access (using ajax call usually) and which will contact your JIRA instance (from the web server) and perform the actual authentication and data retrieval and return the data back to your javascript code (through the reply to the ajax request).

Consider the following image:

Your JavaScript code is executed in User's Browser. It contacts your web server (in this image it is labeled as "Page on Your Server"), where you have your java server page (proxy page) which contacts your JIRA server (in this image it is labeled as "Third-Party Web Service").

I hope it is a bit more clear now how can you achieve your privacy, since you keep all the credentials on your web server and not sending it to the user's browser.

[Phillip Ponzer [Cprime]]

Is this the only way? Or can this be done utilizing Confluence's application link to JIRA?

[MB]

Application Links can be used (I've done it several times), but from one JIRA server to another JIRA server (more precisely, from one Atlassian product server to another Atlassian product server), not from the client browser to the JIRA server.

Your options are:

1) Use proxy

2) Use application links (looks like a proxy, but it's actually the same if not worse, because you access one JIRA/Confluence server to be able to access another JIRA server, so you still need credentials to authenticate to the first of those two servers that your JavaScript will access)

3) Prompt a user to input authentication (login) info and/or use OAuth

4) If your JIRA REST service is public (doesn't require login info) you don't even need to authenticate. Especially if you are writing that REST service, maybe you can make it anonymous/public.

Try reading this article to get more info about your possibilities: JIRA REST API Tutorials