Uploaded image for project: 'Jira Cloud'
  1. Jira Cloud
  2. JRACLOUD-82823

Reusing already expired jwt token for loading connect app iframes upon switching issues (SPA logic problem)

    XMLWordPrintable

Details

    • Suggestion
    • Resolution: Fixed
    • Issue - View
    • None
    • 4
    • 4
    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    Description

      Issue Summary

      Connect apps occasionally fail to load inside the Jira issue page views, with Atlassian Jira SPA (single page app) mechanisms fail to re-issue properly fresh jwt-token when user navigates back to already cached issue view. If you navigate back to an issue after 15min, the JWT will have already expired and the connection to the app will fail, causing an unauthorized error message.

      Steps to Reproduce

      1. Have a Connect app that uses a module in the issue view, e.g. webpanel.
      2. Open Issue 1 screen, and open the connect app. Note the JWT used to call the app URL.
      1. Use SPA navigation (i.e quick search in the top right corner) to switch to another Jira ticket.
      2. Wait 15 minutes - this is needed as default jwt token expiration time is set to 15 minutes.
      3. use SPA navigation (i.e. quick search) to switch to the Jira ticket from point (2). It will be loaded instantly this time, from the browser cache/memory. No full page reload. However, the app panels will attempt to contact vendor host using the same (or nearly the same, with marginal difference in expiration date) token as used in point 2, which is already expired. This results in authorization failures.

      Expected Results

      Application loads and renders correctly.

      Actual Results

      Unauthorized error.

      Workaround

      A fix was applied where if the app data is cached, the app will automatically reload. In edge cases, such as when more than 15 minutes have passed or if an app was initially closed and then reopened, we will provide a button for users to reload the page. However we need to improve upon this solution.

      Attachments

        Issue Links

          Activity

            People

              dboyd@atlassian.com boydo
              ab6ef5b5ed7f Harsaranjeet Kaur
              Votes:
              49 Vote for this issue
              Watchers:
              15 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: