Description

Problem
The native Profile Picture macro does not render a user's avatar photo when placed inside a third-party "bodied" macro (e.g., Aura Panel / Aura Tab) that renders its content within a cross-origin iframe. The macro correctly displays the photo in Edit mode and when placed outside the third-party macro on the same page, but falls back to showing default initials in View (Published) mode when nested inside the iframe context.

Root Cause
Third-party bodied macros such as Aura Panel render their inner content inside a cross-site iframe (e.g., hosted on aura.cloudanvil.net). When the Profile Picture macro inside that iframe requests the user's avatar via the /wiki/aa-avatar/{accountId} endpoint, the browser's cross-site privacy policies (SameSite cookie restrictions) block the Confluence session cookie from being sent with the request. The request therefore arrives at Confluence unauthenticated.

Without a valid session, Confluence cannot confirm whether the user has a real profile photo uploaded and falls back to rendering the default initials-based avatar.

The issue is with how the aa-avatar endpoint handles unauthenticated requests.

How to Reproduce

1. On a Confluence Cloud page, add a third-party bodied macro that renders its content in a cross-origin iframe (e.g., Aura Panel).
2. Inside that macro, insert the native Profile Picture macro for a user who has a profile photo uploaded.
3. Save/publish the page.
4. In View mode, observe that the profile picture shows initials instead of the actual photo.
5. Place the same Profile Picture macro outside the third-party macro on the same page — it renders the photo correctly.
6. Open the page in Edit mode — the photo also renders correctly inside the third-party macro (editor does not use the iframe rendering pipeline).

Affected Endpoint
/wiki/aa-avatar/{accountId}

Expected Behaviour
The /wiki/aa-avatar/{accountId} endpoint should resolve and return the user's public avatar image using only the account ID, without requiring an authenticated session. Profile photos should render correctly regardless of whether the request originates from a same-origin or cross-origin context.

Actual Behaviour
When the avatar request originates from a cross-origin iframe (a third-party macro), the browser blocks the session cookie. The endpoint treats the request as unauthenticated and falls back to initials instead of resolving the avatar.

Workaround

NA