Configuring the allowlist

Jira administrators can choose to allow incoming and outgoing connections and content from specified sources by adding URLs to the allowlist. 

Jira will display an error if content has been added that is not from an allowed source, and prompt the user to add the URL to the allowlist.

Application Links are automatically added to the allowlist. You don't need to manually add them.

For all of the following procedures, you must be logged in as a user with the Jira Administrators global permission.

Add allowed URLs to the allowlist

  1. Choose > System
  2.  Select Security > Whitelist.

  3. Enter the URL or expression you want to allow.
  4. Choose the Type of expression (see Expression Types below for examples).
  5. Choose Allow Incoming if you need to allow CORS requests (see below).
  6. Choose Add

Your URL or expression appears in the allowlist.

To test that your allowlisted URL is working as expected, you can enter a URL in the Test a URL field. Icons will indicate whether incoming or outgoing traffic is allowed for that URL.

Expression types

When adding a URL to the allowlist, you can choose from a number of expression types. 

Domain nameAllows all URLs from the specified domain.
Exact matchAllows only the specified URL.
Wildcard ExpressionAllows all matching URLs. Use the wildcard * character to replace one or more characters.http://*
Regular ExpressionAllows all URLs matching the regular expression.http(s)?://www\.example\.com

Allow incoming

Allow Incoming enables CORS requests from the specified origin. The URL must match the format scheme://host[:port], with no trailing slashes (:port is optional). So not allow CORS requests from the domain

Disabling the allowlist

The allowlist is enabled by default. You can choose to disable the allowlist however this will allow all URLs, including malicious content, and is not recommended. 

  1. Choose > System
  2.  Select Security > Whitelist.
  3. Click the Turn off allowlist button.
  4. Choose Confirm

All URLs will now be allowed. Unless your instance is running in an environment without internet access, we do not recommend disabling the allowlist.

Last modified on Jun 30, 2020

Was this helpful?

Provide feedback about this article
Powered by Confluence and Scroll Viewport.