# How to use ACE addon.authenticate(true)

**URL:** <https://community.developer.atlassian.com/t/how-to-use-ace-addon-authenticate-true/48780>\
**Category:** Jira Cloud\
**Tags:** nodejs, jwt, ac-express, security\
**Created:** [June 10, 2021, 12:32pm UTC](https://community.developer.atlassian.com/t/how-to-use-ace-addon-authenticate-true/48780 "2021-06-10T12:32:27Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ProfitDeveloper](https://avatars.discourse-cdn.com/v4/letter/p/f19dbf/32.png) [@ProfitDeveloper](https://community.developer.atlassian.com/u/ProfitDeveloper)\
**Post date:** [June 10, 2021, 12:32pm UTC](https://community.developer.atlassian.com/t/how-to-use-ace-addon-authenticate-true/48780/1 "2021-06-10T12:32:27Z")

</div>

Hi Team,

We have used nodejs and have developed our addon. We went through the below document

> [@Action required: Atlassian Connect vulnerability allows bypass of app qsh verification via context JWTs](https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072):
>
> [Update May 7 2021] - Please upgrade to Atlassian Connect Spring Boot 2.1.5 or later, 2.1.4 regressed on the fix introduced in 2.1.3 What is changing? Atlassian is making a breaking API change to Atlassian Connect in Jira and Confluence Cloud to mitigate a vulnerability in the verification of the qsh claim in Connect JWT authentication. Is my app impacted? If your app uses an [authentication descriptor setting](https://developer.atlassian.com/cloud/jira/platform/connect-app-descriptor/#authentication) other than none, then it’s highly likely your app is impacted and will need to be …

1. As mentioned in the document we are using “type”: “jwt”,“alg”: “HS256” in the authentication of atlassian-connect.json
2. We added apiMigrations": {“gdpr”: true, “context-qsh”: true } in the atlassian-connect.json
3. We have installed npm i -g atlassian-connect-express
4. Now we tried adding addon.authenticate(true) in the endpoints and we are getting addon undefined error

Is there any dependency to be included. Please help us in resolving it