Resolving Cross-Origin Issues in JIRA API Calls

Other Questions Jira
1

Hey folks, I’m stuck with a tricky problem. I’m trying to use the JIRA REST API in a Confluence User Macro, but I’m hitting a wall with CORS issues. The problem is that JIRA and Confluence are on different domains, so the browser’s preflight request is failing.

I’ve tried a bunch of things to fix this:

  • Added CORS headers in Apache for both JIRA and Confluence
  • Whitelisted Confluence in JIRA and vice versa
  • Tested with different browsers (Chrome, Firefox, Safari)

Here’s a sample of the JavaScript that’s causing trouble:

MyApp.makeRequest({
  method: 'GET',
  endpoint: 'http://jira.example.com/api/v1/tickets',
  query: 'status=open&priority=high',
  dataType: 'json',
  contentType: 'application/json',
  async: false
});

I’m getting an error about the Same Origin Policy blocking the request. I’ve even tried testing with cURL and Postman, but I’m not getting anywhere.

Has anyone run into this before? Any ideas on how to get JIRA and Confluence talking to each other across domains? I’m really stumped here and could use some expert advice. Thanks!

2

I’ve encountered this issue before and found that using a server-side proxy can be an effective solution. Instead of making direct API calls from your JavaScript, you can configure a small server-side script on your Confluence server to act as an intermediary. When your client code sends a request, the script receives it and forwards the call to JIRA. After processing, it returns the JIRA response back to your JavaScript. This approach bypasses CORS restrictions and offers the opportunity to implement security measures like authentication and error logging.

3

I’ve faced similar challenges with CORS when integrating JIRA and Confluence. One solution that worked for me was setting up a reverse proxy on the Confluence server. This way, your JavaScript can make requests to a URL on the same domain as Confluence, which then forwards the request to JIRA.

Here’s a basic Apache configuration I used:

ProxyPass /jira-api http://jira.example.com/api
ProxyPassReverse /jira-api http://jira.example.com/api

Then, in your JavaScript, you’d change the endpoint to:

endpoint: '/jira-api/v1/tickets'

This approach bypasses CORS issues entirely. It’s secure and doesn’t require changes to JIRA’s configuration. Just make sure to properly secure the proxy and consider rate limiting to prevent abuse.

Another option is using server-side scripting in Confluence to make the API calls, avoiding browser restrictions altogether. This might be more complex but offers more control over the integration.

4

hey dave, have you tried using a JSONP approach? it’s an oldie but goodie for cross-domain stuff. basically you wrap your API call in a callback function. might look something like this:

$.ajax({
  url: 'http://jira.example.com/api/v1/tickets?callback=?',
  dataType: 'jsonp',
  success: function(data) {
    // handle the response
  }
});

just make sure JIRA supports JSONP. it’s not perfect but could be a quick fix!