"Allow anonymous users" is automatically selected when "Allow incoming" is selected in Bamboo Data Center Allowlist feature
Platform Notice: Data Center - This article applies to Atlassian products on the Data Center platform.
Note that this knowledge base article was created for the Data Center version of the product. Data Center knowledge base articles for non-Data Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
The Bamboo Allowlist feature allows the Administrator to control inbound and outbound traffic to and from the Bamboo instance based on several URL types and criteria.
When adding a new entry to the Bamboo Allowlist, you may notice that selecting the "Allow Incoming" option automatically enables the "Allow Anonymous Users" option as well. There is no way to disable anonymous user access without also turning off the "Allow Incoming" option.
Solution
Upon registration, the Allowlist feature in Bamboo automatically grants the application authenticated outbound access to the registered URL. If customers require additional anonymous outbound access, they can select the "Allow anonymous access" option and save their configuration. This will enable the necessary outbound traffic based on their defined scope. No incoming traffic is enabled at this stage.
The Allow Incoming checkbox enables CORS requests from the specified origin. If incoming access to the Bamboo server is needed from an external endpoint, such as an Application Link or a WebHook initiator, the Allowlist can't enforce authenticated traffic. This limitation arises because authentication may occur at a later stage, beyond the initial scope of the Allowlist. Consequently, the "Allow anonymous access" checkbox is automatically selected in such cases.
Please refer to the table below for details on what to expect from each combination of Allowlist configurations.
| URL/Expression | Allow Incoming | Allow anonymous access | RESULTS | Granted Outbound | Granted Incoming | Granted Anonymous access |
|---|---|---|---|---|---|---|
| URL |  | |
|  | | |
| URL | | | | | | |
| URL | | | | | |