Jira attachment upload "XSRF check failed" in CI

By Kaveh Alemi·Latchkey

Jira blocks attachment uploads that look like cross-site requests. The upload must send X-Atlassian-Token: no-check and be multipart/form-data with the file field named file, or Jira rejects it.

What this error means

A POST to /issue/KEY/attachments fails with "XSRF check failed" or a 403/415, even though auth is valid and the issue exists.

HTTP/1.1 403 Forbidden
XSRF check failed. Include the header X-Atlassian-Token: no-check on attachment requests.

Common causes

Missing X-Atlassian-Token header

The attachments endpoint enforces XSRF protection and requires X-Atlassian-Token: no-check on the upload request.

Wrong multipart shape or field name

The request is not multipart/form-data, or the file part is not named file, so Jira cannot read the attachment.

How to fix it

Send the token header and correct multipart

1. Add -H "X-Atlassian-Token: no-check" to the upload.
2. Use multipart form with the file part named file.
3. Keep basic auth on the request as usual.

curl -sf -u "$JIRA_EMAIL:$JIRA_API_TOKEN" \
  -H "X-Atlassian-Token: no-check" \
  -F "file=@build/report.html" \
  "https://your-domain.atlassian.net/rest/api/3/issue/ABC-123/attachments"

Confirm Create Attachments permission

A 403 that is not XSRF may be a permission gap; grant the account Create Attachments in the project scheme.

How to prevent it

• Always add X-Atlassian-Token: no-check to attachment uploads.
• Send multipart/form-data with the file part named file.
• Grant the CI account Create Attachments permission.

Frequently asked questions

Related guides

References

• GitHub Actions documentation