Why Jira Cloud Shows "XSRF Security Token Missing" and How to Fix It

What the "XSRF Security Token Missing" Error Means

In Jira Cloud, the message "XSRF security token missing" appears when the platform cannot validate a request's Cross‑Site Request Forgery (XSRF) token. XSRF tokens are short‑lived, cryptographically signed values that browsers must send with state‑changing operations (POST, PUT, DELETE). If the token is absent, expired, or does not match the server's expectation, Jira rejects the request to protect against malicious third‑party actions.

Common Scenarios That Trigger the Error

The error can surface in several everyday contexts:

• Using the Jira Cloud web UI after a long period of inactivity.
• Calling Jira REST APIs from custom scripts, CI pipelines, or third‑party integrations.
• Embedding Jira gadgets or iframes on external sites.
• Browser extensions that block or strip cookies and headers.

Understanding the root cause helps you apply the correct remedy without repeatedly encountering the same issue.

How XSRF Protection Works in Jira Cloud

Jira Cloud follows the standard double‑submit cookie pattern:

When a user authenticates, Jira sets a session cookie (JSESSIONID) and a separate XSRF cookie (atlassian.xsrf.token).

For every state‑changing request, the client must send the XSRF token value in an HTTP header (X‑Atlassian‑Token: no-check for read‑only calls or the actual token for writes).

The server compares the header value to the cookie. A mismatch causes the "XSRF security token missing" response, typically HTTP 403.

This mechanism works the same for the web UI and REST endpoints, which is why the same error can appear in both places.

Step‑by‑Step Troubleshooting Guide

1. Refresh the Browser Session

If you encounter the error while using the UI, start by reloading the page and, if needed, signing out then back in. This forces Jira to issue a fresh XSRF cookie.

2. Verify Cookie and Header Presence

Open the browser's developer tools (Network tab) and inspect a failing request:

• Confirm the atlassian.xsrf.token cookie is present.
• Check that the request includes the X‑Atlassian‑Token header with the same value.

If either is missing, the request will be rejected.

3. Adjust API Calls in Scripts

When using curl, PowerShell, or a programming language's HTTP client, explicitly add the header:

curl -X POST "https://your-domain.atlassian.net/rest/api/3/issue" \ -H "Authorization: Bearer " \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "X-Atlassian-Token: " \ -d '{"fields":{...}}'

Retrieve by first calling the /rest/auth/1/session endpoint or by reading the cookie from a prior authenticated request.

4. Disable Browser Extensions That Interfere

Ad blockers, privacy extensions, or corporate web‑security proxies can strip cookies or headers. Temporarily disable them and retry the operation.

5. Use Atlassian's API Tokens Instead of Session Cookies

For server‑to‑server automation, prefer API tokens (generated in your Atlassian account) and the Authorization: Bearer header. When using API tokens, Jira does not require an XSRF token for most endpoints, eliminating the error.

Best Practices to Prevent Future Errors

• Keep Sessions Short‑Lived: Log out after work or use a dedicated API token for automation.
• Include the XSRF Header by Default: Configure your HTTP client library to always send X‑Atlassian‑Token with the cookie value.
• Monitor Cookie Expiry: Jira's XSRF cookie typically lives for 30 minutes of inactivity. Refresh it before long‑running scripts exceed this window.
• Test in Incognito Mode: A clean profile isolates the issue from cached cookies or extensions.

Quick Reference Table

When to Contact Atlassian Support

If you have verified that the cookie and header are correct, the error persists across browsers and after clearing caches, the issue may be a backend configuration problem. Provide Atlassian with:

• Exact request URL and method.
• Full request and response headers (redact auth tokens).
• Timestamp and account ID.

Support can check for known incidents or tenant‑specific security policies that could block the token.

Summary

The "XSRF security token missing" error in Jira Cloud is a protective response to an absent or mismatched CSRF token. By ensuring the atlassian.xsrf.token cookie and the X‑Atlassian‑Token header travel together, refreshing sessions, and favoring API tokens for automation, you can eliminate the error and maintain smooth operation of both the UI and REST integrations.