Import Automation as JSON fails with an Unknown error in Jira Data Center
Platform Notice: Data Center Only - This article only applies to Atlassian apps on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
When attempting to import an automation as JSON in Jira, the following error message appears in the browser:
"An unknown error has occurred. Please reload the page and try again."
In the browser's network logs, an HTTP 403 error code is logged with the response "XSRF check failed".
Environment
Jira 10.3.13 (LTS)
Root cause
The problem only occurs when Jira is accessed via load balancer/reverse proxy <base-url>. The issue does not occur if a single node of Jira is accessed directly, bypassing the load balancer/reverse proxy.
The server receives requests from the same origin, as the form page and the form submission are from the same origin; thus, the XSRF HTTP header matches. However, for the XSRF check to succeed, the form token and cookie token sent to the server must match. The problem occurs because modern web browsers (beginning Chrome 80+) do not accept the atlassian.xsrf.cookie initially sent by the server in an iframe as it is treated as cross-site and is therefore rejected.
Solution
Add header to proxy/load balancer
The following workaround will disable XSRF checks for the Automation Import Call.
Modify the reverse proxy / load balancer / WAF to add the following header to the request as it makes its way to the Jira node:
Automation Import Request URL:
Condition: Method: POST
Condition: Request URL: <
Jira_BASE_URL>/rest/cb-automation/latest/project/GLOBAL/rule/import/*Action: Add header:
X-Atlassian-Token: no-check
Please replace <Jira_BASE_URL> with the actual Base URL of your instance.
Was this helpful?