Jira Assistant

shridhar.tl@gmail.com

Jira Assistant Issues

View #271 on GitHub to know more details

#271 - Encryption of cookie data

GregoryMachin commented on Feb 07, 2023

Checklist before you being

I am sure that I am already using latest version of Jira Assistant
I had verified that there are no existing requests with similar suggestion in issue tracker
I had verified that, my query is not answered in FAQ section of website

How do you use Jira Assistant?

Browser extension

Are you using cloud version of Jira or self hosted (data center / server) of Jira.

Cloud Jira

Version of Jira Assistant

2.47

What browser are you using?

Edge

Feature Suggestion

Hi,

To use new applications, we need to have the application reviewed by our security team. Overall the security team was satisfied that Jira Assistant met their requirements. They did say that they would prefer that the cookies were encrypted.

Would it be possible to encrypt the cookie data in future or at least the Jira related content ?

Thank you Greg

Checklist before you submit

I have ensured not to paste any confidential information like Jira url, Mail id, etc.
I have added required screenshots (as necessary)

shridhar-tl commented on Jan 23, 2023

Hi @GregoryMachin - Jira Assistant does not create or store or directly use any cookie data. So I am not sure what cookie data are you talking about. JA just do a COR request to Jira where browser automatically send the cookies stored by Jira as part of the request. Jira Assistant do not have any control over any cookie stored by Jira and is sent as part of request.

Kindly send a snapshot of what data are you talking about encrypting and if JA has control over it, I would be happy to have it encrypted as rest. But once again I would like to highlight that JA or any library used by JA does not create or store any cookies.

shridhar-tl commented on Jan 25, 2023

Hi @GregoryMachin - Any updates on this?

shridhar-tl commented on Feb 07, 2023

Hi @GregoryMachin - Please provide additional details as requested and please feel free to reopen this ticket.

Latest updates

27-Nov-2023 - Change in permissions for JA

In upcoming version (v2.58) of JA, by default, permission to access Cloud instance of Jira would be added. This would let the users to integrate with Cloud instance of Jira without prompting for permission at the time of integration. Hence for Chrome users, once the extension gets updated, it would get disabled due to change in permission. You can enable it again from Extensions page. However, for Firefox and Edge, extension already have access to all the sites (though it doesn't really need) which would be narrowed down only to atlassian.net which would be a security improvement.

03-Jan-2023 - Auto update would take time

Jira Assistant is now updated in phased basis to avoid any breaking changes impacting all users. So it may take long time before your extension gets updated. If you want to manually update it immediately, just navigate to "chrome://extensions", turn on "Developer mode" from top right corner and click Update button. Then you can turn off dev mode.

20-Dec-2022 - Available as App for Jira Cloud

Jira Assistant can now be installed within your Jira Cloud as an App. Once installed, this would be available for all your Jira users. Visit https://www.jiraassistant.com to know more.

26-Jul-2022 - Introducing JA Web

You can visit https://app.jiraassistant.com to use or test upcoming features of Jira Assistant. Contribute in testing JA by switching to Web Version. All the fixes and new feature updates would be immediately available in Web version of JA. Later, stable updates would be pushed to Extensions.

🟢