# Send a request from an iframe is receiving a 401

**URL:** <https://community.developer.atlassian.com/t/send-a-request-from-an-iframe-is-receiving-a-401/47305>\
**Category:** Jira Cloud\
**Created:** [April 21, 2021, 3:33pm UTC](https://community.developer.atlassian.com/t/send-a-request-from-an-iframe-is-receiving-a-401/47305 "2021-04-21T15:33:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MartinCassidy](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@MartinCassidy](https://community.developer.atlassian.com/u/MartinCassidy)\
**Post date:** [April 21, 2021, 3:33pm UTC](https://community.developer.atlassian.com/t/send-a-request-from-an-iframe-is-receiving-a-401/47305/1 "2021-04-21T15:33:16Z")

</div>

I’m attempting to follow the example described here: [Bitbucket](https://bitbucket.org/atlassian/atlassian-connect-spring-boot-samples/src/master/atlassian-connect-spring-boot-sample-ajax/)

The ajax request is being sent to my add on successfully, however it always gets a 401. After a little debugging I’ve discovered this is because of the following error “com.atlassian.connect.spring.internal.jwt.JwtInvalidClaimException: Expecting claim ‘qsh’ to have value ‘e3058de8476897ecb7d2f926080bed3007a978d997083949f57d93f5076734df’ but instead it has the value ‘context-qsh’” (found in com.atlassian.connect.spring.internal.auth.RequireAuthenticationHandlerInterceptor)

Not sure what I’m missing, I’ve followed all the steps in the documentation, I can see from the web inspector that the request is being sent with the token derived from the meta tag.

I don’t really want to have to turn off the authorisation with IgnoreJwt (although I have for now to enable me to continue working)

---

<div class="post-metadata">

**Author:** ![marc](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/marc/32/39047_2.png) [@marc](https://community.developer.atlassian.com/u/marc)\
**Post date:** [April 21, 2021, 7:12pm UTC](https://community.developer.atlassian.com/t/send-a-request-from-an-iframe-is-receiving-a-401/47305/2 "2021-04-21T19:12:44Z")

</div>

@MartinCassidy Please have a look here: [Action required: Atlassian Connect vulnerability allows bypass of app qsh verification via context JWTs](https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072) . It seems like you need to change your authorization check.

---

<div class="post-metadata">

**Author:** ![MartinCassidy](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@MartinCassidy](https://community.developer.atlassian.com/u/MartinCassidy)\
**Post date:** [April 22, 2021, 4:43pm UTC](https://community.developer.atlassian.com/t/send-a-request-from-an-iframe-is-receiving-a-401/47305/3 "2021-04-22T16:43:04Z")

</div>

Perfect, thanks!