# New sandboxing of Connect App Iframes in Confluence and Jira **URL:** \ **Category:** Announcements\ **Tags:** announcement, confluence-cloud, jira-cloud, atlassian-connect\ **Created:** [March 20, 2020, 11:01am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699 "2020-03-20T11:01:12Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![mpaisley](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/mpaisley/32/54538_2.png) [@mpaisley](https://community.developer.atlassian.com/u/mpaisley)\ **Post date:** [March 24, 2020, 5:31am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/21 "2020-03-24T05:31:12Z")
Hey Daniel, Are you sure? You will have received a confirmation email from me for all sign ups to the **Cloud Vendor first release** for Jira but I don’t see that site enrolled. Could you be confusing this with the Jira Cloud Vendor Feature Preview sign up? Cloud Vendor Feature preview is similar to a server EAP, it’s usually more than a week or so before release, and it won’t necessarily be the final release as we may make changes or fixes. We’ll use this for big changes where we anticipate apps might need some moderate work to remain compatible. Cloud Vendor First Releases are ready for production, however we’re releasing them first to ecosystem vendors to ensure you’re ahead of your customers. I hope this clarifies. Cheers, Mel ---
**Author:** ![mpaisley](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/mpaisley/32/54538_2.png) [@mpaisley](https://community.developer.atlassian.com/u/mpaisley)\ **Post date:** [March 24, 2020, 5:44am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/22 "2020-03-24T05:44:32Z")
Hey Boris, Similar to my reply to Daniel, it doesn’t look like you’ve actually submitted that jira instance via the link supplied above. Would you try again? You’ll get an email in 24-48 hours confirming your instance has been added. Cheers, Mel ---
**Author:** ![danielwester](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/danielwester/32/36730_2.png) [@danielwester](https://community.developer.atlassian.com/u/danielwester)\ **Post date:** [March 24, 2020, 8:22am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/23 "2020-03-24T08:22:33Z")
I think the fault lies on this side of my monitor then… I’ll drop in requests in a bit. ---
**Author:** ![sergio.vieira](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@sergio.vieira](https://community.developer.atlassian.com/u/sergio.vieira)\ **Post date:** [March 24, 2020, 11:21am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/24 "2020-03-24T11:21:18Z")
`AP.navigation` does not work for us in every situation and we are forced to use `window.parent` in these occasions. We ( [Xray Test Management for Jira](https://marketplace.atlassian.com/apps/1211769/xray-test-management-for-jira) ) would like to be granted an extension on this. ---
**Author:** ![boris](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/boris/32/33588_2.png) [@boris](https://community.developer.atlassian.com/u/boris)\ **Post date:** [March 24, 2020, 3:02pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/25 "2020-03-24T15:02:01Z")
@Dboyd took care of this for me, thanks. ---
**Author:** ![candid](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/candid/32/39734_2.png) [@candid](https://community.developer.atlassian.com/u/candid)\ **Post date:** [March 25, 2020, 1:06pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/26 "2020-03-25T13:06:38Z")
Another thing that I just realised is that we are also using `AP.history` for managing state. As far as I can tell, `AP.navigator.go` doesn’t provide a way to set the location hash. ---
**Author:** ![BenRomberg](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/benromberg/32/51777_2.png) [@BenRomberg](https://community.developer.atlassian.com/u/BenRomberg)\ **Post date:** [March 25, 2020, 1:23pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/27 "2020-03-25T13:23:13Z")
Regarding navigation, we use `` everywhere and it seems to work even with the `sandbox` attributes in place. Since it’s a clickable link, it’s probably considered as `allow-top-navigation-by-user-activation`. ---
**Author:** ![ucchishta.sivaguru](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ucchishta.sivaguru/32/44805_2.png) [@ucchishta.sivaguru](https://community.developer.atlassian.com/u/ucchishta.sivaguru)\ **Post date:** [March 26, 2020, 7:02am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/28 "2020-03-26T07:02:43Z")
Hi @dboyd & @mpaisley, We’re also using `window.top.location.href = ` in 2 of our addons: Redirection - [Redirection for Confluence | Atlassian Marketplace](https://marketplace.atlassian.com/apps/183/redirection-for-confluence?hosting=cloud) Linking - [Linking for Confluence | Atlassian Marketplace](https://marketplace.atlassian.com/apps/166/linking-for-confluence?hosting=cloud) Please enroll us for an extension. Thanks, Ucchishta. ---
**Author:** ![akhaneev](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/akhaneev/32/36099_2.png) [@akhaneev](https://community.developer.atlassian.com/u/akhaneev)\ **Post date:** [March 26, 2020, 8:30am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/29 "2020-03-26T08:30:46Z")
Hi @dboyd , I’ve found an issue: if a Widget Connector macro (with a YouTube video) is used inside a 3rd party macro (for example, Table Filter macro), then it is not possible to open the video in a full-screen mode and JS exception is thrown: ```auto Failed to construct 'PresentationRequest': The document is sandboxed and lacks the 'allow-presentation' flag. ``` ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [March 26, 2020, 9:54am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/30 "2020-03-26T09:54:02Z")
Thanks @akhaneev I’ve raised this internally to see if we can add `allow-presentation` Will comment on this thread with a response soon ---
**Author:** ![snath](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@snath](https://community.developer.atlassian.com/u/snath)\ **Post date:** [March 26, 2020, 5:13pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/31 "2020-03-26T17:13:24Z")
Hi @dboyd We are using `window.top.location.href = ` in our app in a number of places, therefore, we would like to request an extension so we can test the impact of this change on our app and implement potential workarounds/fixes. > **[zAgile Connector for Salesforce and Jira Cloud | Atlassian Marketplace](https://marketplace.atlassian.com/apps/1212981/connector-for-salesforce-and-jira-cloud?hosting=cloud&tab=overview)** > > zAgileConnect delivers rich Salesforce and Jira Cloud integration. Supports integration of Jira Issues with Salesforce objects Regards, zAgile ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [March 31, 2020, 7:49am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/32 "2020-03-31T07:49:56Z")
After investigation, we’re not currently aware of any apps that are dependant on `allow-presentation` to support their functionality. We’ve chosen not to include it at this stage ---
**Author:** ![BenRomberg](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/benromberg/32/51777_2.png) [@BenRomberg](https://community.developer.atlassian.com/u/BenRomberg)\ **Post date:** [March 31, 2020, 8:08am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/33 "2020-03-31T08:08:40Z")
While there may not be any apps that absolutely depend on the presentation mode being available, it will surely cause confusion for our users if videos cannot be expanded to fullscreen mode anymore. For us, this mainly affects our “Getting Started” pages where we have embedded Youtube videos that explain our apps. It is the first point of contact with our customers and we’d rather leave a good impression. It would be a shame if those videos would become hard to watch because of small fonts etc. if they could no longer be enlarged, especially for users with impaired vision. Also, shouldn’t the consideration which sandbox attributes are allowed be more regarding security and user experience and less about which apps are currently depending on those attributes? ---
**Author:** ![Alexander\_Leonhard](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/alexander_leonhard/32/39589_2.png) [@Alexander\_Leonhard](https://community.developer.atlassian.com/u/Alexander_Leonhard)\ **Post date:** [April 2, 2020, 5:15pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/34 "2020-04-02T17:15:37Z")
Hey, I found this conversation while I was trying to figure out what’s going on with our Jira Cloud App, which is currently not displayed correctly and is not loading any values in dropdowns. After talking with one of our engineers, we both think this change is most likely blocking our Jira Cloud App from working. Therefore, it would be awesome to get an extension for this @dboyd until we could find a fix. You can find our app here: > **[QA Service for Jira | Atlassian Marketplace](https://marketplace.atlassian.com/apps/1217073?tab=overview&hosting=cloud)** > > QA Service for Jira brings Test IO’s network of professional testers, who test your app on real world devices, right to Jira Thanks! ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [April 2, 2020, 10:47pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/35 "2020-04-02T22:47:57Z")
@Alexander_Leonhard Please load all.js from the CDN. See [Deprecation of xdm\_e Usage](https://community.developer.atlassian.com/t/deprecation-of-xdm-e-usage/32768) ---
**Author:** ![dboyd](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/dboyd/32/35894_2.png) [@dboyd](https://community.developer.atlassian.com/u/dboyd)\ **Post date:** [April 3, 2020, 7:00am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/36 "2020-04-03T07:00:09Z")
The rollout of the sandboxing has begun, and will be rolled out slowly over the following weeks. We will be monitoring as closely as we can for affected apps. Vendors with apps that have signalled they are affected are still excluded, while we find alternatives. If you have just found this thread and your app is affected please comment here or message me directly to request a temporary exclusion for your app so we can discuss alternatives. ---
**Author:** ![Alexander\_Leonhard](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/alexander_leonhard/32/39589_2.png) [@Alexander\_Leonhard](https://community.developer.atlassian.com/u/Alexander_Leonhard)\ **Post date:** [April 3, 2020, 9:57am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/37 "2020-04-03T09:57:25Z")
Thanks, will look into it. ---
**Author:** ![BobBergman](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/bobbergman/32/38962_2.png) [@BobBergman](https://community.developer.atlassian.com/u/BobBergman)\ **Post date:** [April 17, 2020, 2:33pm UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/38 "2020-04-17T14:33:17Z")
Second these points! ---
**Author:** ![anton2](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/anton2/32/39888_2.png) [@anton2](https://community.developer.atlassian.com/u/anton2)\ **Post date:** [April 24, 2020, 8:20am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/39 "2020-04-24T08:20:30Z")
Totally agree. Don’t understand why presenting videos is dangerous. ---
**Author:** ![johan.b.brodin](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@johan.b.brodin](https://community.developer.atlassian.com/u/johan.b.brodin)\ **Post date:** [April 24, 2020, 11:50am UTC](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699/40 "2020-04-24T11:50:42Z")
This is also blocking showing PDF in iFrames. We missed this post so users are reporting this which breaks the app completely. Will try to understand how to ping you David but please find the Jira plugin below. > **[Easy Word, HTML PDF Export in Jira & Microsoft Word | Atlassian Marketplace](https://marketplace.atlassian.com/apps/1218555/issue-export-to-pdf-html-word-documents?hosting=cloud&tab=overview)** > > Customizable issue export made easy with drag & drop and ready templates - issues, timesheet, invoice, release note, report, tempo [Previous page](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699.md?page=1) [Next page](https://community.developer.atlassian.com/t/new-sandboxing-of-connect-app-iframes-in-confluence-and-jira/36699.md?page=3)