# Authenticating url on server side

**URL:** <https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476>\
**Category:** Jira Cloud\
**Tags:** jira-developers, jira-plugin, jira-software, jira-cloud, rest-api\
**Created:** [October 12, 2018, 10:16am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476 "2018-10-12T10:16:06Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![hariprasath](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hariprasath/32/37018_2.png) [@hariprasath](https://community.developer.atlassian.com/u/hariprasath)\
**Post date:** [October 12, 2018, 10:16am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/1 "2018-10-12T10:16:06Z")

</div>

In client side I have written my code as below,

```auto
$.ajax({
 type: "GET",
 beforeSend: function (request) {
  var jwt = document.head.querySelector("[name~=token][content]").content;
  request.setRequestHeader("Authorization", 'JWT '+ jwt);
 },
 url: "/test",
 success: function(data){
   alert("success");
 }
});

```

using this ajax request from client side I want to get the data on server side by authenticating the jwt token sent from client side. Server side(router code) is below,

```auto
app.get('/test', addon.checkValidToken(), function(req, res){
 ....
});

```

So, how can I authenticate or validate the url using jwt token by sending through request.SetHeaderRequest? I referred this [url](https://bitbucket.org/atlassian/atlassian-connect-express), but I couldn’t figure out any solution for it.

Also, I referred another [link](https://community.developer.atlassian.com/t/jwt-authentication-of-post-request-from-iframe-back-to-host/17939). It was mentioned that Get method was working with that code, but unfortunately it didn’t work for me. So, can anyone give me a solution for this?

---

<div class="post-metadata">

**Author:** ![acalantog](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/acalantog/32/37988_2.png) [@acalantog](https://community.developer.atlassian.com/u/acalantog)\
**Post date:** [November 5, 2018, 2:17am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/2 "2018-11-05T02:17:24Z")

</div>

Hi @hariprasath.

I saw your posts [here](https://community.developer.atlassian.com/t/jwt-authentication-of-post-request-from-iframe-back-to-host/17939) and [here](https://community.developer.atlassian.com/t/how-to-access-atlassian-connect-express-backend-end-points-from-frontend-js/4193).

In your server side code (router), to have your calls authenticated with jwt, if you’re using ACE, what I do is have the `addon.authenticate()` as part of the dependency as such:

If you’re using your add-on user to invoke REST APIs:

```auto
app.get('/hello-world', addon.authenticate(), function (req, res) {
    let httpClient = addon.httpClient(req);

    httpClient.get({
                url: `rest/api/<version>/<endpoint>`,
                contentType: 'application/json',
                json: true
            }, (error, res, body) => {
                //do something about the body
            });
});

```

If you’re acting as a user:

```auto
httpClient.asUser('admin').get({
                url: `rest/api/<version>/<endpoint>`,
                contentType: 'application/json',
                json: true
            }, (error, res, body) => {
                //do something about the body
            });

```

Cheers,  
Anne Calantog

---

<div class="post-metadata">

**Author:** ![hariprasath](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hariprasath/32/37018_2.png) [@hariprasath](https://community.developer.atlassian.com/u/hariprasath)\
**Post date:** [November 5, 2018, 9:17am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/3 "2018-11-05T09:17:49Z")

</div>

Hi @acalantog,

I have used the code in client side as below,

```auto
$.ajax({
	type: "GET",
	url: "/hello-world",
	dataType: "json",
	contentType: "application/json",
	success: function(data){
		// my code
	}
});

```

and in server side as,

```auto
app.get('/hello-world', addon.authenticate(), function (req, res) {
        ...    
});

```

Still I get the issue - ‘Authentication verification error: 401 Could not find authentication data on req  
uest’, when the above code is used in server side(add-on user to invoke REST APIs).

---

<div class="post-metadata">

**Author:** ![acalantog](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/acalantog/32/37988_2.png) [@acalantog](https://community.developer.atlassian.com/u/acalantog)\
**Post date:** [November 6, 2018, 4:16am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/4 "2018-11-06T04:16:15Z")

</div>

Hi @hariprasath,

Hmm, I see. I think I understand now what you want to do. So I have this in my server side:

```auto
app.get('/get-via-jwt', addon.checkValidToken(), function() {
    console.log('Able to access this!');
});

```

And for me to access this resource in my js from the front-end, I added a meta tag:  
`<meta name="token" content="{{token}}"/>`

and in my js, this is how I call the endpoint:

```auto
let jwt_token = $('meta[name="token"]').attr('content');

$.ajax({
    url: "/get-via-jwt",
    type: "GET",
    headers: {
        'Authorization' : `JWT ${jwt_token}`
    },
    success: function() { alert('Success!' + authHeader); }
});

```

And you should be able to access your endpoint that’s validated by jwt.

Let me know if you need anything else.

Cheers,  
Anne Calantog

---

<div class="post-metadata">

**Author:** ![hariprasath](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hariprasath/32/37018_2.png) [@hariprasath](https://community.developer.atlassian.com/u/hariprasath)\
**Post date:** [November 8, 2018, 10:30am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/5 "2018-11-08T10:30:56Z")

</div>

Hi @acalantog,

Thanks a lot. It works perfectly. Now, I am able to validate the ajax request using the jwt token.

Cheers,  
Hari Prasath

---

<div class="post-metadata">

**Author:** ![hariprasath](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hariprasath/32/37018_2.png) [@hariprasath](https://community.developer.atlassian.com/u/hariprasath)\
**Post date:** [November 8, 2018, 1:13pm UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/6 "2018-11-08T13:13:02Z")

</div>

Hello @acalantog

I have another question over here. When I load the page, I can get jwt token within meta tag. But, when redirecting to another page, there I do not find jwt token, the content within tag is empty when inspected.

```auto
<meta name="token" content=""/>

```

So, how can I access jwt token there?

---

<div class="post-metadata">

**Author:** ![mski](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@mski](https://community.developer.atlassian.com/u/mski)\
**Post date:** [September 2, 2020, 2:10pm UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/7 "2020-09-02T14:10:46Z")

</div>

> [@acalantog](#):
>
> console.log(‘Able to access this!’);

Hi.  
I’m attempting to do exactly what is shown in your example.  
However I am getting the following error.

{} Authentication verification error (401): Invalid JWT: Not enough or too many JWT token segments; should be 3.

Are there any updates on how this should be done?

---

<div class="post-metadata">

**Author:** ![SyedRafay](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@SyedRafay](https://community.developer.atlassian.com/u/SyedRafay)\
**Post date:** [February 14, 2022, 6:45am UTC](https://community.developer.atlassian.com/t/authenticating-url-on-server-side/24476/8 "2022-02-14T06:45:50Z")

</div>

Worked for me as well.

- Add the token in html head tag: `<meta name="token" content="{{token}}">`
- Extract the token in script: `var token = document.querySelector('meta[name="token"]').content`
- Append Authorization in request headers before sending request back to addon (server) from iframe client (Jira in my case) `RequestHeaders["Authorization"] = "JWT ${token}"`
- Lastly, use `addon.checkValidToken()` in your route instead of `addon.authenticate()`