Webhooks sanitized during migration to Jira Cloud
Platform Notice: Cloud and Data Center - This article applies equally to both cloud and data center platforms.
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
Jira Cloud Migration Assistant (JCMA) removes Basic Auth credentials from webhook URLs during migration to ensure security and migration success.
After migrating from Jira Server or Data Center to Jira Cloud, you may find that certain webhooks are no longer functioning. This occurs because Jira Cloud does not support Basic Authentication credentials (username and password) embedded directly within a webhook URL.
To prevent migration failures, the Jira Cloud Migration Assistant (JCMA) automatically "sanitizes" these URLs by removing the sensitive credentials.
Diagnosis
To confirm if your webhooks were affected:
Open your Post-migration report in Jira Cloud.
Look for events related to Webhook URL sanitization.
The report will list the specific webhooks that were modified during the migration process.
Cause
Jira Cloud security policies prohibit the use of Basic Auth credentials in webhook URLs. Previously, migrations would fail if these were detected. JCMA now trims these credentials so the migration can complete, but the webhook will require manual reconfiguration to work again.
Solution
To restore functionality to your webhooks, you must update them to use a supported authentication method.
Step 1: Identify the affected webhooks
Review the post-migration report to get a list of all sanitized webhook names and their original (now modified) URLs.
Step 2: Update the webhook in Jira Cloud
Go to Settings (⚙️) > System.
In the left panel, select Webhooks.
Locate the sanitized webhook from your report.
Update the URL field to the correct endpoint (without the embedded credentials).
Step 3: Implement a supported authentication method
Jira Cloud webhooks support more secure methods than Basic Auth in the URL. We recommend using:
Secret tokens (HMAC): Add a secret to your webhook configuration. Jira will use this to sign the request, and your receiving service can verify the signature.
Custom Headers: If your receiving service requires specific headers for authentication, you can configure these in the webhook settings.
For detailed instructions on securing webhooks, see Webhooks.
Was this helpful?