Skip to content

GitLab for Jira Cloud app does not work with Jira custom domains via the Atlassian Marketplace

Summary

The GitLab for Jira Cloud app cannot be used with a Jira custom domain when installing the GitLab for Jira Cloud app via the Atlassian Marketplace.

This is because on GitLab.com we have enabled CSP and the Jira custom domains are not dynamically added to the CSP header.

If a user attempts to click the Get started button after installing the GitLab for Jira Cloud app from the Atlassian Marketplace, the app will show a loading spinner for a while before showing a Something went wrong on our end error.

Steps to reproduce

  1. Sign up for a Jira Premium plan
  2. Add a custom domain to Jira
  3. Install the GitLab for Jira Cloud app via the Atlassian Marketplace
  4. Click the Get started button and observe the problem

Example Project

N/A

What is the current bug behavior?

The GitLab for Jira Cloud app does not work with Jira custom domains.

What is the expected correct behavior?

The GitLab for Jira Cloud app should work with Jira custom domains.

Relevant logs and/or screenshots

The browser console will show this error:

Refused to frame 'https://gitlab.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' https://*.atlassian.net https://*.jira.com".
Add-on iframe timed out for add-on gitlab-jira-connect-gitlab-com

jira-custom-domain-issue

Output of checks

This bug happens on GitLab.com

Possible fixes

If you refer to the video, we can clearly see that the browser is preventing the frame from loading.

We allow these ancestors in app/controllers/jira_connect/subscriptions_controller.rb#L4:

ALLOWED_IFRAME_ANCESTORS = [:self, 'https://*.atlassian.net', 'https://*.jira.com'].freeze

Do we need to allow custom domains here or remove the allowed iframe ancestors?

There could be other problems beyond this point once the iframe ancestors are fixed.

Workarounds

Edited by 🤖 GitLab Bot 🤖