Viewing inline images and attachment thumbnails on a public Jira issue as an anonymous user fails to render media content on some sites

XMLWordPrintable

    • 1
    • Severity 3 - Minor

      Issue Summary

      When a Jira Business project has Browse Projects set to Public (anonymous access enabled), anonymous users can view issue text and comment text but inline images and attachment thumbnails do not render. The FileCard React component calls setIsCardVisible(true) when the card enters the viewport, but the component does not re-render, preventing the useFilePreview hook from executing and fetching the media file from the CDN.

      Authenticated users viewing the same issue see all media content correctly. The REST API returns full attachment metadata (including file IDs and ADF media nodes) to anonymous users, and direct file downloads work for anonymous sessions, confirming this is not an access/permissions issue.

      Steps to Reproduce

      1. Create a Company-managed Business project in Jira Cloud
      2. Set the permission scheme so that Browse Projects is granted to Public (anyone, including anonymous users)
      3. Create an issue with inline image attachments in the description or comments
      4. Open the issue URL in a private/incognito browser window (ensure no Atlassian session exists)
      5. Observe the issue page loads and text content is visible
      6. Observe that inline images and attachment thumbnails remain in a loading state indefinitely

      Expected Results

      Jira sites Inline images and attachment thumbnails render correctly for anonymous users, matching the behavior seen by authenticated users in all Jira sites.

      Actual Results

      In Some Jira Sites (not all) Inline images and attachment thumbnails remain in a perpetual loading state. The browser makes zero requests to api.media.atlassian.com or media-cdn.atlassian.com. The items API call completes successfully and returns attachment metadata, but the subsequent media file fetch never fires.

      The below exception is thrown in the browser console:

      {
          "sentFrom": "jira.frontend.issue.agg-transformers.attachments",
          "message": "Invalid parent name undefined for attachment undefined",
          "event": {},
          "buildKey": "MRJF-PROD-20082",
          "logTime": "2026-05-29T04:29:45.433Z",
          "browserName": "Chrome",
          "browserVersion": "148.0.0.0"
      } 

      Additionally, debugging confirms that setIsCardVisible(true) is called by the IntersectionObserver callback, but the FileCard component does not re-render. The useFilePreview hook (which triggers the media fetch when skipRemote = false) never executes because it depends on the re-render that does not occur properly in sequence while anonymous access is enabled.

      Workaround

      Currently there is no known workaround for this behavior. Users must be logged in to view inline images and attachments. A workaround will be added here when available.

              Assignee:
              Unassigned
              Reporter:
              Earl McCutcheon
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: