# Breaking behavior with Anonymous users and Atlassian Spring Connect

**URL:** <https://community.developer.atlassian.com/t/breaking-behavior-with-anonymous-users-and-atlassian-spring-connect/103152>\
**Category:** Adopting Forge from Connect\
**Tags:** atlassian-connect\
**Created:** [October 7, 2026, 6:18am UTC](https://community.developer.atlassian.com/t/breaking-behavior-with-anonymous-users-and-atlassian-spring-connect/103152 "2026-10-07T06:18:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\
**Post date:** [October 7, 2026, 6:18am UTC](https://community.developer.atlassian.com/t/breaking-behavior-with-anonymous-users-and-atlassian-spring-connect/103152/1 "2026-10-07T06:18:20Z")

</div>

We’re relying (until migration to Forge completes) on the Atlassian Spring Connect for the Forge Remote implementation.

Our app also supported anonymous Confluence users. It behaved slightly different when detected a anonymous user. We checked if `AtlassianHostUser.getUserAccountId().isEmpty()` to do so.

When you move the endpoint to a Forge Remote, the ``AtlassianHostUser``is set as before. **HOWEVER** : the `AtlassianHostUser.getUserAccountId()` is then set for anonymous users. It is set to `unidentified` for anonymous users.

This means, our existing code missed the anonymous users and assumed they are logged in.

---

<div class="post-metadata">

**Author:** ![MitchMcCue](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@MitchMcCue](https://community.developer.atlassian.com/u/MitchMcCue)\
**Post date:** [October 7, 2026, 7:26am UTC](https://community.developer.atlassian.com/t/breaking-behavior-with-anonymous-users-and-atlassian-spring-connect/103152/2 "2026-10-07T07:26:22Z")

</div>

Thanks for the heads up @RomanStoffel!

Looks as though `unidentified` is the value provided in the `principal` field of the [Forge invocation token (FIT)](https://developer.atlassian.com/platform/forge/remote/essentials/#the-forge-invocation-token--fit-) for anonymous users, rather than this being ACSB-specific behaviour.

---

<div class="post-metadata">

**Author:** ![RomanStoffel](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/romanstoffel/32/42175_2.png) [@RomanStoffel](https://community.developer.atlassian.com/u/RomanStoffel)\
**Post date:** [October 7, 2026, 7:51am UTC](https://community.developer.atlassian.com/t/breaking-behavior-with-anonymous-users-and-atlassian-spring-connect/103152/3 "2026-10-07T07:51:17Z")

</div>

Correct: The Force Invocation Tokens FIT principal is set to `unidentified` for anonymous users. This is then taken 1:1 by the Atlassian Spring Connect implementation and breaks the previous behavior where was no `getUserAccountId` for anonymous user.

Just to clarify: We’ll just fix in our application. We’ll soon drop the Atlassian Spring Connect framework anyway. Just letting everyone know =).