Issue Summary

After upgrading to Jira/JSM Data Center 10.3.20 or later, downloading a ProForma form as PDF or XLSX from the Jira issue view (agent side) stops working, instead, de-authing the user session (logging them out).

Steps to Reproduce

• Deploy Jira/JSM Data Center 10.3.20 (or later) with ProForma 10.4.4
• Log in as an authenticated agent user WITHOUT ticking the "Remember Me" option
• Open any JSM issue with at least one ProForma form attached (e.g. ITSD-42)
• On the form, click the [...] button, then choose one of Download PDF, Download Rich PDF, or Download XLSX

Expected Results

The form downloads successfully as PDF (or XLSX), as it does on Jira/JSM Data Center 10.3.19 and earlier with the same ProForma build.

Actual Results

• The form does not download
• The user session was instead logged out
• Upon inspecting the Network traffic, the browser receives an error 401 (or 403 potentially if a third party authentication plugin is used)

It is possible to download the form by entering the link into the browser address bar, eg: /rest/proforma/api/1/issues/$issueKey/forms/$formId/pdf

Workaround

You can leverage one of the following workarounds below.

We recommend testing any workaround in an non-production environment to ensure they have the desired effect

Workaround 1

• Users can tick the "Remember Me" option at login, so the seraph.rememberme.cookie is set on the browser
• This workaround depend on the Remember Me persistent authentication path being available. Environments on which SSO/SAML is configured with Remember Me is disabled by policy, so another workaround will need to be attempteed

Workaround 2

Use your reverse proxy or load balancer to drop invalid auth bearer headers on their way to the application:

Authorization: Bearer null
Authorization: Bearer undefined
Authorization: Bearer 

Workaround 3

Add to your announcement banner the following code block:

<!-- BEGIN FORMDC-871 WORKAROUND -->
<script>    
(() => {
    const PATCHED = '__proformaFetchAuthorizationPatch';
    if (window[PATCHED]) return;
    if (!/(?:\/queues\/custom\/|\/browse\/|\/issues\/)/.test(window.location.pathname)) return;
    
    const originalFetch = window.fetch.bind(window);  
    
    window.fetch = (input, init) => {
        const request = input instanceof Request ? input : null;
        const url = String(request?.url || input || '');
        const headers = new Headers(init?.headers || request?.headers);
        const authorization = headers.get('Authorization') || '';
        const isBrokenAuth = /^Bearer\s+(undefined|null|)$/i.test(authorization);
        const isProForma = /\/rest\/proforma\//.test(url);
        
        if (isBrokenAuth && isProForma) {
            headers.delete('Authorization');
            console.log('[FORMDC-871 workaround] Stripped broken Authorization header:', { url });
            return originalFetch(input, { ...init, headers });
        }
        
        return originalFetch(input, init);
    };
    
    window[PATCHED] = true;
    console.log('[FORMDC-871 workaround] Installed.');
})();
</script>
<!-- END FORMDC-871 WORKAROUND -->

Limitations - This will only fix the problem for the JSM Agent view, not the customer portal view. This is because the portal does not load the announcement banner by design

Please exercise caution when updating the Announcement Banner and ensure that the entire script provided is used. Should you encounter any difficulties, kindly use the described methods to remove the announcement banner: https://support.atlassian.com/jira/kb/how-to-change-announcement-banner-using-sql-query-no-rest-api-available/