# New sandboxing of Connect App Iframes in Confluence and Jira **URL:** \ **Category:** Announcements\ **Tags:** announcement, confluence-cloud, jira-cloud, atlassian-connect\ **Created:** [March 20, 2020, 11:01am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699 "2020-03-20T11:01:12Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [March 20, 2020, 11:01am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/1 "2020-03-20T11:01:12Z")
##### Summary For improved security we will be adding [sandboxing](https://www.w3schools.com/tags/att_iframe_sandbox.asp) to Connect App Iframes with the following initial allowlist: - allow-forms - allow-modals - allow-popups - allow-same-origin - allow-scripts - allow-top-navigation-by-user-activation (Firefox: allow-top-navigation) This change has already been rolled out to sites in the [Jira](http://go.atlassian.com/jc-eco-beta) and [Confluence](http://go.atlassian.com/cc-eco-beta) Ecosystem Beta Groups for testing and will be rolled out to the general public beginning Wednesday 1st April (changed from Wednesday 25th March) In general most apps should be unaffected, however if your app does anything outside of the allowlist you will be affected. Some examples are: - access `window.parent` or `window.top` directly from inside your Iframe’s JavaScript (eg. setting `window.top.location.href` without a user gesture) - modify `document.domain` of your Iframe or any nested Iframe If this is the case, please reply to this announcement so we can grant your app an extension and work with you to find an alternative solution ---
**Author:** ![nchakarov](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/nchakarov/32/39476_2.png) [@nchakarov](https://community.developer.atlassian.com/u/nchakarov)\ **Post date:** [March 20, 2020, 11:16am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/2 "2020-03-20T11:16:19Z")
Hello, we are using nested iframe in our plugin. Are these changes going to affect the plugin? ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [March 20, 2020, 11:49am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/3 "2020-03-20T11:49:14Z")
Hi @nchakarov, welcome to the developer community! Nested iframes will be affected under the following known conditions: - The app’s top Iframe and nested Iframe share a second-level domain, and manipulates `document.domain` in order to allow cross-frame communication. Please see a more detailed explanation [here](https://javascript.info/cross-window-communication#windows-on-subdomains-document-domain) ---
**Author:** ![candid](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/candid/32/39734_2.png) [@candid](https://community.developer.atlassian.com/u/candid)\ **Post date:** [March 20, 2020, 11:50am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/4 "2020-03-20T11:50:11Z")
This change breaks Scroll Documents in several places where we use `parent.location.href = ...` to redirect the user somewhere. The reason why we are using that method for redirecting at all is because of the following drawbacks in the Confluence Cloud JavaScript API: - `AP.navigator.go` only allows to specify `customData` when navigating to an `addonModule`. We need it as well when navigating to a `contentview` and to a `contentlist`, and I don’t see why it shouldn’t be allowed for any kind of navigator target. - `AP.flag.create` doesn’t allow to specify a `href` for the actions. This is not only annoying for the users, because they cannot open the action in a new tab, but it also forces us to manually redirect the user in reaction to the `flag.action` event. It would be nice if those issues could be fixed and the sandbox be disabled until then. ---
**Author:** ![jack](https://avatars.discourse-cdn.com/v4/letter/j/cc9497/32.png) [@jack](https://community.developer.atlassian.com/u/jack)\ **Post date:** [March 20, 2020, 12:32pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/5 "2020-03-20T12:32:53Z")
You are giving vendors **1 week** to check their software, signal problems here, and find a solution. We are not affected as far as I can see, but I still cannot believe what I read. ---
**Author:** ![nchakarov](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/nchakarov/32/39476_2.png) [@nchakarov](https://community.developer.atlassian.com/u/nchakarov)\ **Post date:** [March 20, 2020, 12:36pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/6 "2020-03-20T12:36:33Z")
Thank you very much, @dboyd ---
**Author:** ![danielwester](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/danielwester/32/36730_2.png) [@danielwester](https://community.developer.atlassian.com/u/danielwester)\ **Post date:** [March 20, 2020, 1:01pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/7 "2020-03-20T13:01:44Z")
How can we make sure which instances are in the Jira Ecosystem Beta group? Because the instance I thought was in it isn’t showing any sandbox params on the iframes. ☹ /Daniel ---
**Author:** ![GrzegorzTaczyk](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/grzegorztaczyk/32/39331_2.png) [@GrzegorzTaczyk](https://community.developer.atlassian.com/u/GrzegorzTaczyk)\ **Post date:** [March 20, 2020, 1:01pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/8 "2020-03-20T13:01:48Z")
@dboyd The original post links to w3schools, but it might be more beneficial for community to use more exhaustive source of knowledge about sandboxing: [https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) ---
**Author:** ![onucheidoko](https://avatars.discourse-cdn.com/v4/letter/o/7bcc69/32.png) [@onucheidoko](https://community.developer.atlassian.com/u/onucheidoko)\ **Post date:** [March 20, 2020, 1:04pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/9 "2020-03-20T13:04:52Z")
Hi @dboyd This change will break a few navigation in our application, because we currently use `window.open("url", "_top")`. We noticed that some features in our application broke yesterday, because of this change. We have tried several combinations using AP.navigator.go, but it does not work for us, because it has limited targets and it does not support concrete url at the moment. Please, grant our app an extension and what other alternative solution do we have. Thank you. SoftComply Team ---
**Author:** ![raimonds.simanovskis](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/raimonds.simanovskis/32/618_2.png) [@raimonds.simanovskis](https://community.developer.atlassian.com/u/raimonds.simanovskis)\ **Post date:** [March 20, 2020, 3:01pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/10 "2020-03-20T15:01:18Z")
We are using `window.top.location.href = ` in several cases in eazyBI and this will break our app functionality. We are using it to redirect - from a configuration page to our general page - we use URLs with additional parameters in our emails - when user clicks the link and opens this email we capture additional URL parameters but then we want to redirect to the main app page without additional parameters. Please do not do such quick change without allowing us to find if we can do any alternative solutions. ---
**Author:** ![boris](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/boris/32/33588_2.png) [@boris](https://community.developer.atlassian.com/u/boris)\ **Post date:** [March 20, 2020, 3:20pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/11 "2020-03-20T15:20:50Z")
I enrolled [https://imatincr.atlassian.net](https://imatincr.atlassian.net) and am seeing the sandbox properly in Confluence, but not in Jira. What should I do to get this addressed? I would like to get this fixed ASAP since we have so little time to implement any fixes. ---
**Author:** ![BobBergman](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/bobbergman/32/38962_2.png) [@BobBergman](https://community.developer.atlassian.com/u/BobBergman)\ **Post date:** [March 20, 2020, 4:07pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/12 "2020-03-20T16:07:43Z")
We also use `window.top.location = ...` in multiple apps to redirect to other pages within Confluence. This is a very aggressive timeline to expect apps to react. Can you at least provide an API on `AP` to do safer redirects to pages within the host app? ---
**Author:** ![danielwester](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/danielwester/32/36730_2.png) [@danielwester](https://community.developer.atlassian.com/u/danielwester)\ **Post date:** [March 20, 2020, 4:20pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/13 "2020-03-20T16:20:43Z")
We enrolled [55deg-daniel.atlassian.net](http://55deg-daniel.atlassian.net) - nothing on the Jira side as well. @mpaisley @nmansilla help? ---
**Author:** ![BobBergman](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/bobbergman/32/38962_2.png) [@BobBergman](https://community.developer.atlassian.com/u/BobBergman)\ **Post date:** [March 20, 2020, 7:12pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/14 "2020-03-20T19:12:02Z")
We tested the apps we were concerned about but they still seem to be working. We have another app that may be affected in some user use cases but I think we can workaround that with documentation. ---
**Author:** ![dzagorovsky](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dzagorovsky/32/35913_2.png) [@dzagorovsky](https://community.developer.atlassian.com/u/dzagorovsky)\ **Post date:** [March 21, 2020, 11:17am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/15 "2020-03-21T11:17:10Z")
Hi @dboyd, There is a bitbucket-cloud tag in your post. How we can test our Bitbucket Cloud app before changes will be rolled out to the general public? Thanks, Dmitry ---
**Author:** ![pete](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@pete](https://community.developer.atlassian.com/u/pete)\ **Post date:** [March 22, 2020, 5:33pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/16 "2020-03-22T17:33:06Z")
Hi @dboyd, We are also using `window.top.location` to redirect to the creation page of custom content in Confluence. This is a workaround because `AP.navigator.go` does not allow to go to the creation page, but only content view and edit (see [Editcomponent for custom content](https://community.developer.atlassian.com/t/editcomponent-for-custom-content/6041)). Cheers Peter ---
**Author:** ![george1](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/george1/32/39506_2.png) [@george1](https://community.developer.atlassian.com/u/george1)\ **Post date:** [March 22, 2020, 6:43pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/17 "2020-03-22T18:43:57Z")
The list of targets for `AP.navigator.go` is limited. How can we redirect to an arbitrary Jira page, for instance, ticket search? [https://developer.atlassian.com/cloud/jira/platform/jsapi/classes/jira/](https://developer.atlassian.com/cloud/jira/platform/jsapi/classes/jira/) ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [March 23, 2020, 4:16am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/18 "2020-03-23T04:16:58Z")
Thank you everyone for your feedback The rollout will now be delayed until **Wednesday 1st April** in order to ensure vendors that are concerned have time to enrol in the Beta group and let us know if they need to be initially excluded As stated in the announcement, if you have reason to believe your app is affected and request an extension you will not need your app to be fixed by this date Please note that enrolling a site in the Beta group is a manual process at our end and may take a day or two. If you are familiar with Chrome dev tools, you can test your app now in any product by adding the sandbox attribute and reloading your iframe. In the top window in your dev tools console: ```auto const myAppKey = "..."; // your app key const mySelector = "iframe[id*='"+myAppKey+"']"; document.querySelectorAll(mySelector).forEach(el => el.setAttribute("sandbox", "allow-forms allow-modals allow-popups allow-scripts allow-same-origin allow-top-navigation-by-user-activation")); ``` Navigate to your iframe in the dev tools console: `window.location.reload();` ---
**Author:** ![m.kuijpers](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/m.kuijpers/32/35905_2.png) [@m.kuijpers](https://community.developer.atlassian.com/u/m.kuijpers)\ **Post date:** [March 23, 2020, 1:27pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/19 "2020-03-23T13:27:39Z")
First off awesome that Atlassian is improving security for Iframes. We tried fixing our addon which uses `window.top` to redirect to our app and link to certain of our own pages. So we tried `AP.navigation` and it is not working for us. We have a `webitem` with a context of `addon` and it simply creates the wrong url… ```auto AP.navigator.go('addonModule', {'addonKey': 'nl.avisi.jira.plugins.relations-for-jira', 'moduleKey': 'atlas-crm-application', 'customData': {'route': '/settings/getting-started'}}) ``` this generates: - https://{your-base-url}.atlassian.net/plugins/servlet/ac/nl.avisi.jira.plugins.relations-for-jira/ac-redirect?ac.route=%2Fsettings%2Fgetting-started But it should be - https://{your-base-url}.atlassian.net/plugins/servlet/ **ac-redirect** /nl.avisi.jira.plugins.relations-for-jira/ac-redirect?ac.route=%2Fsettings%2Fgetting-started I think if you want to roll out changes like this it would be a very good idea to fix the `AP.navigator` API because this seems to be the main problem for all vendors. But for now we would like to enroll with an extension for Atlas CRM for Confluence and for Jira until `AP.navigator` get’s fixed: - [Atlas CRM - Customers and Sales in Jira | Atlassian Marketplace](https://marketplace.atlassian.com/apps/1213313/atlas-crm-customers-and-sales-in-jira?hosting=cloud&tab=overview) - [Atlas CRM - Customers in Confluence | Atlassian Marketplace](https://marketplace.atlassian.com/apps/1216060/atlas-crm-customers-in-confluence?hosting=cloud&tab=overview) ---
**Author:** ![candid](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/candid/32/39734_2.png) [@candid](https://community.developer.atlassian.com/u/candid)\ **Post date:** [March 23, 2020, 2:23pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/20 "2020-03-23T14:23:54Z")
We have an app module `k15t-docs-documents-overview-page` that is configured to be the content list for the custom content type `ac:k15t-scroll-document-versions-for-confluence:document`. We want to navigate there and set the custom parameter `activeDocumentId`. So far we could do it like this: ```auto parent.location.href = `${baseUrl}/display/SPACEKEY/customcontent/list/ac:k15t-scroll-document-versions-for-confluence:document?ac.activeDocumentId=123`; ``` Now we have two options: ```auto AP.navigator.go('contentlist', { spaceKey: 'SPACEKEY', contentType: 'ac:k15t-scroll-document-versions-for-confluence:document' }); AP.navigator.go('addonModule', { addonKey: 'k15t-scroll-document-versions-for-confluence', moduleKey: 'k15t-docs-documents-overview-page', customData: { activeDocumentId: '123' } }); ``` The first one doesn’t allow us to specify `customData`, and the second one doesn’t allow us to specify a `spaceKey` (and creates inconsistent URLs). [Next page](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699.md?page=2)