Node脚本中POST请求可调用JIRA接口，本地前端运行却失败

Hey there, let's break down why your JIRA Issue creation code works in Node but fails in a React app button click—here are the most likely culprits and how to check them:

1. CORS (Cross-Origin Resource Sharing) Restrictions #

This is the #1 issue when moving server-side code to the browser. Your Node script runs on the server, so it doesn't face browser-enforced CORS rules. But when your React app (hosted on localhost:3000 or your production domain) sends a request directly to JIRA, the browser will block it unless JIRA's server explicitly allows your frontend origin.

• How to check: Open your browser's DevTools → Network tab. Look for a CORS-related error in the console, or check the response headers of your failed request—if there's no Access-Control-Allow-Origin header matching your frontend domain, this is the problem.
• Fixes:
  • If you control the JIRA server, add your frontend domain to JIRA's CORS allowed origins list;
  • Set up a proxy in your React app (using setupProxy.js for Create React App) to forward requests from your frontend to JIRA. The proxy acts as a middleman, bypassing browser CORS checks.

2. Insecure/Blocked Authentication Method #

You're using Basic Auth with a hardcoded my_auth_token in the frontend—this is not only a huge security risk, but many JIRA instances block Basic Auth requests from browsers as a security policy.

• How to check: In DevTools Network tab, verify that the Authorization header is actually being sent with your request. Also, check JIRA's admin settings to see if browser-side Basic Auth is restricted.
• Fixes:
  • Use a backend proxy: Have your React app send the issue details to your own backend server, then let the backend call JIRA's API (just like your Node script does). This keeps your auth token secure and avoids browser restrictions;
  • Switch to OAuth 2.0: If you must call JIRA directly from the frontend, use JIRA's OAuth 2.0 flow—it's the recommended secure method for browser-based clients.

3. TLS Certificate Validation Issues #

In your Node script, you disabled TLS certificate checks with process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0", but browsers don't respect this environment variable. If JIRA uses a self-signed or untrusted SSL certificate, the browser will block the request with a NetworkError.

• How to check: Go to DevTools → Security tab to check the certificate status of your JIRA domain, or look for SSL errors in the Network tab's request details.
• Fixes:
  • Install a trusted SSL certificate on your JIRA server (the best long-term solution);
  • For development only: Manually trust JIRA's certificate in your browser (visit the JIRA domain, click the security warning in the address bar, and add an exception).

4. Mismatched Request Details #

Double-check that your React request is identical to the working Node script:

• Confirm the Content-Type header is exactly application/json;
• Verify that your issue payload (especially custom fields like customfield_10902 and customfield_10008) is being serialized correctly to JSON;
• Make sure the JIRA API URL is identical (no missing slashes, typos in the domain, etc.).

5. JIRA Permissions or IP Whitelisting #

Some JIRA instances restrict API access by IP address or require specific permissions for browser-based requests:

• Check if your frontend's server IP is on JIRA's allowed IP list;
• Ensure the account used in your auth token has the necessary permissions to create issues, and that those permissions aren't limited to internal/non-browser requests.

Pro tip: Always start by digging into your browser's DevTools Network tab—looking at the full request/response details (including error messages) will usually point you straight to the problem.

内容的提问来源于stack exchange，提问作者singmotor