Skip to content

Opt in to atlassians new context qsh

Lukas 'ai-pi' Eipert requested to merge 328267-context-qsh into master

What does this MR do?

Atlassian introduces a change to their JWTs for Connect apps.

There are two types of JWT, the one being affected (Context JWT) is not utilized by us. Therefore we do not need to do any code changes in the auth logic. This change only opts in to the new security model they are rolling out on June 7th.

For more details see: #328267 (closed)

Changelog: changed

Screenshots (strongly suggested)

Walkthrough of me testing the feature before / after: https://youtu.be/VojlhxOMCUc

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #328267 (closed)

Edited by Lukas 'ai-pi' Eipert

Merge request reports