# Guide on how to resolve breaking changes for Attlassian connect lifecycle

**URL:** <https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430>\
**Category:** Jira Cloud\
**Tags:** ac-express, lifecycle, jira-cloud, atlassian-connect\
**Created:** [March 4, 2022, 10:57am UTC](https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430 "2022-03-04T10:57:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TutsekRobert](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@TutsekRobert](https://community.developer.atlassian.com/u/TutsekRobert)\
**Post date:** [March 4, 2022, 10:57am UTC](https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430/1 "2022-03-04T10:57:24Z")

</div>

Hello,

I have an app posted on the marketplace which was affected by the:  
[Action Required - Atlassian Connect installation lifecycle security improvements](https://community.developer.atlassian.com/t/action-required-atlassian-connect-installation-lifecycle-security-improvements/49046) security improvement.

I am using Jira Cloud with Atlassian Connect Express and I followed the steps in the guide related to Express apps, but I am not sure that I need to change something in my code as well.

The thing is I am not using the installed hook In my app and on uninstalled I am only removing the user from the database. (I am using the addon.authenticate() function from express to let the app access sensitive routes)/

Do I need to change something else in my code as well besides this?

PS:  
I changed addon.authentificate to addon.authenticateInstall() on /uninstalled endpoint and addon.checkValidToken() on protected routes which render handlebars templates. I don’t have a /install hook declared.

Regards,  
Robert

---

<div class="post-metadata">

**Author:** ![HanjooSong](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hanjoosong/32/42713_2.png) [@HanjooSong](https://community.developer.atlassian.com/u/HanjooSong)\
**Post date:** [March 6, 2022, 11:02pm UTC](https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430/2 "2022-03-06T23:02:52Z")

</div>

Hi, if your app does not require `install` hook, I think you can just disable jwt auth from your descriptor. Sounds like you don’t need the `sharedSecret` which is being sent to your app during install hook callback.

```auto
 {
    "key": "your.app.key",
    "name": "your app name",
    ... , 
    "authentication": {
        "type": "none"
    },
    ...
}

```

Thanks.

---

<div class="post-metadata">

**Author:** ![TutsekRobert](https://avatars.discourse-cdn.com/v4/letter/t/b2d939/32.png) [@TutsekRobert](https://community.developer.atlassian.com/u/TutsekRobert)\
**Post date:** [March 7, 2022, 10:52am UTC](https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430/3 "2022-03-07T10:52:50Z")

</div>

Hello,

But I think I need the jwt because I use it when I send a request to our servers for a user to generate an API key with us which is stored as a user property in jira.

Regards,  
Robert

---

<div class="post-metadata">

**Author:** ![HanjooSong](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/hanjoosong/32/42713_2.png) [@HanjooSong](https://community.developer.atlassian.com/u/HanjooSong)\
**Post date:** [March 8, 2022, 1:23am UTC](https://community.developer.atlassian.com/t/guide-on-how-to-resolve-breaking-changes-for-attlassian-connect-lifecycle/56430/4 "2022-03-08T01:23:12Z")

</div>

Hi, based on your comment, I think you are already using pre-defined /install hook which is built in ACE framework by default.  
This install hook will take care of this breaking change for you, and there is nothing else you need to change apart from changing `/uninstalled` to use `addon.authenticateInstall()` which you have already mentioned. Sorry for the confusion.