# Action Required: Deprecating support for passing Connect JWTs as a query string parameter to Atlassian APIs **URL:** \ **Category:** Announcements\ **Tags:** confluence-cloud, jira-cloud, atlassian-connect\ **Created:** [August 2, 2021, 2:00am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540 "2021-08-02T02:00:04Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![cmacneill](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/cmacneill/32/36089_2.png) [@cmacneill](https://community.developer.atlassian.com/u/cmacneill)\ **Post date:** [August 2, 2021, 2:00am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/1 "2021-08-02T02:00:04Z")
## What is changing? As per [Understanding JWT for Connect apps](https://developer.atlassian.com/cloud/jira/platform/understanding-jwt-for-connect-apps/#creating-a-jwt-token), the Jira and Confluence APIs today allow Connect apps to provide authentication JWTs as either an `Authorization: JWT` header in requests, or as a `?jwt=` query string parameter. Following this deprecation period, Atlassian APIs will no longer accept Connect app JWTs as a query string parameter. This change does not affect how Jira or Confluence provides the Atlassian product JWTs to Connect app modules/iframes. ## Why is it changing? Accepting sensitive JWTs as a query string parameter presents a problem as the query string is often saved in web browser history, passed through Referers to other web sites, stored in web logs such as intermediate proxy servers. ## What do I need to do? If your app provides its Connect JWT to the Atlassian APIs as a query string parameter, you must update it to pass the JWT via an `Authorization: JWT` header. ## By when do I need to do it? We’re removing `?jwt=` query string support from the Jira and Confluence APIs by **Feb 1, 2022.** After this date, the Atlassian Jira and Confluence APIs will no longer inspect the `?jwt=` query string parameter and requests from your app may fail with a HTTP 401 response. ---
**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\ **Post date:** [August 2, 2021, 4:19am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/2 "2021-08-02T04:19:25Z")
Nice! There is one use case I can think of that currently only works with query string JWT: downloading attachments from Jira. There is currently no API for this, so the only way for Connect apps to do this is to do a GET request to `/secure/attachments/{id}` with the JWT as a query string parameter. Would it be possible to either open up the media API or provide another means for apps to download attachments? ---
**Author:** ![zsims](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/zsims/32/41907_2.png) [@zsims](https://community.developer.atlassian.com/u/zsims)\ **Post date:** [August 2, 2021, 7:50am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/3 "2021-08-02T07:50:07Z")
> [@remie](#): > > There is currently no API for this, so the only way for Connect apps to do this is to do a GET request to `/secure/attachments/{id}` with the JWT as a query string parameter. Good point! There’s a new API that went out for Confluence last week: [New Download attachment REST API endpoint](https://community.developer.atlassian.com/t/new-download-attachment-rest-api-endpoint/50398) For the existing API, the recommended approach is: - If your app server needs the attachment, specify the JWT via header; or - If the end user needs the attachment, rely on session authentication. E.g. redirect them to `https://.atlassian.net/secure/attachments/...` if they’re logged in, the attachment will download. ---
**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\ **Post date:** [August 2, 2021, 8:11am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/4 "2021-08-02T08:11:05Z")
> [@zsims](#): > > Confluence last week Is that API also available for Jira? Because as far as I know, there is no existing API available for Jira to download attachments. ---
**Author:** ![dmorrow](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dmorrow/32/35895_2.png) [@dmorrow](https://community.developer.atlassian.com/u/dmorrow)\ **Post date:** [August 2, 2021, 8:32am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/5 "2021-08-02T08:32:57Z")
Hi @remie , I think you can download Jira attachments by specifying the JWT in an `Authorization` header rather than a query parameter. Have you given it a go? Regards, Dugald ---
**Author:** ![remie](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/remie/32/34985_2.png) [@remie](https://community.developer.atlassian.com/u/remie)\ **Post date:** [August 2, 2021, 8:58am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/6 "2021-08-02T08:58:48Z")
Ah yes, you’re right, that works 🎉 ---
**Author:** ![james.dellow](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/james.dellow/32/35848_2.png) [@james.dellow](https://community.developer.atlassian.com/u/james.dellow)\ **Post date:** [August 5, 2021, 8:51pm UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/7 "2021-08-05T20:51:59Z")
@cmacneill it would be good to add a stronger deprecation notice to the documentation [https://developer.atlassian.com/cloud/confluence/understanding-jwt/#creating-a-jwt-token](https://developer.atlassian.com/cloud/confluence/understanding-jwt/#creating-a-jwt-token) ---
**Author:** ![james.dellow](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/james.dellow/32/35848_2.png) [@james.dellow](https://community.developer.atlassian.com/u/james.dellow)\ **Post date:** [August 8, 2021, 2:37am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/8 "2021-08-08T02:37:22Z")
@cmacneill should we expect that Atlassian is also going to make this change when passing JWTs to our apps? ---
**Author:** ![RhysDiab](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/rhysdiab/32/38004_2.png) [@RhysDiab](https://community.developer.atlassian.com/u/RhysDiab)\ **Post date:** [August 8, 2021, 11:12pm UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/9 "2021-08-08T23:12:45Z")
I’m also interested in this. I suspect this doesn’t just include passing JWTs to Atlassian APIs. Does this mean we can no longer pass Context JWTs to our apps in a query string? The [ACE documentation](https://bitbucket.org/atlassian/atlassian-connect-express/src/master/) currently says: > In order to secure your route, the token must be part of the HTTP request back to the add-on service. This can be done by using the standard `jwt` query parameter: > > `See more` ---
**Author:** ![zsims](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/zsims/32/41907_2.png) [@zsims](https://community.developer.atlassian.com/u/zsims)\ **Post date:** [August 9, 2021, 2:55am UTC](https://community.developer.atlassian.com/t/action-required-deprecating-support-for-passing-connect-jwts-as-a-query-string-parameter-to-atlassian-apis/50540/10 "2021-08-09T02:55:17Z")
> [@james.dellow](#): > > @cmacneill should we expect that Atlassian is also going to make this change when passing JWTs to our apps? The change Conor outlined is solely for app → Atlassian JWTs (not Atlassian → apps). Many, if not all, of the JWTs via query strings are passed to apps via the web browser. For example, iframe modules are rendered as with `