Address not allowed when using tunnel

Jira Development Jira Cloud
1

In manifest I set permission for fetch backend and add url, but when I use forge tunnel, every fetch is getting same error “{message: “Address not allowed”}”.

Any idea how to fix this?

Thank you

2

Can you share the code that is making the fetch request and your manifest?

3

sure, here is fetch:

const response = await fetch("https://sentinel.whitehatsec.com/api/source_vuln/" + vulnId + ";assetID=" +assetId + "/notes?key=" + apiKey + "&format=json", {method: "POST", body: JSON.stringify({
                content: note,
            })});

manifest:

permissions:
  scopes:
    - storage:app
    - manage:jira-project
    - manage:jira-configuration
    - read:jira-user
    - read:jira-work
    - write:jira-work
  external:
    fetch:
      backend:
        - https://sentinel.whitehatsec.com

If I am not tunneling app is working correctly.

4

Do you have any outbound firewalls that would be causing errors on your local machine?

I have not been able to reproduce. Here is the small proof of concept code sample I made to try to repro with no success:

manifest.yml

modules:
  webtrigger:
    - key: app-webtrigger-async
      function: async
  function:
    - key: async
      handler: index.runAsync
permissions:
  external:
    fetch:
      backend:
        - https://sentinel.whitehatsec.com
app:
  id: ...

src/index.js

import { fetch } from '@forge/api';

exports.runAsync = async () => {

  const vulnId = 1;
  const assetId = 2;
  const apiKey = 3;
  const note = 'hello';

  const response = await fetch("https://sentinel.whitehatsec.com/api/source_vuln/" + vulnId + ";assetID=" +assetId + "/notes?key=" + apiKey + "&format=json", {method: "POST", body: JSON.stringify({
                content: note,
            })});
  console.log(response);
  return await response.json();
};

When I trigger the webtrigger by visiting the webtrigger’s URL, I get a 401:

status: 401,
statusText: ‘Unauthorized’

Which I expect as I assume you need an API key to make a valid request. Regardless, a 401 indicates that the request is making it out from my local machine to the internet.

5

Yes it was firewall issue.
Thank you for help