Issue with Retrieving Client Key in Confluence Cloud Macro Using Express.js and atlassian-connect-ex

[Nizam Mohamed]

Dear Atlassian Support Team,

I am developing a Confluence Cloud macro using Express.js and atlassian-connect-express. The macro is functioning correctly for most customers; however, I have encountered an issue where, for some customers, the client key is not retrieved correctly.

Issue Description:

When multiple customers trigger requests simultaneously, the client key appears to be overwritten by the client key of the last customer who made a request. As a result, API calls that rely on the client key for authentication and data retrieval fail for some customers.

Code Implementation:

Below is a simplified version of my implementation, where I store the client key in a global variable for use in subsequent API calls:

var Globlas_Clientkey = '';

app.get('/configure', addon.authenticate(), function (req, res) {
    Globlas_Clientkey = req.context.clientKey;
    addon.settings.get('configuration', req.context.clientKey).then(function (configObject) {
        if (configObject && configObject.clientKey) {
            if (configObject.clientKey !== req.context.clientKey) {
                console.log(`Mismatch in client key: Expected ${req.context.clientKey}, Retrieved ${configObject.clientKey}`);
                configObject = null;
            }
        }
        res.render('configure', { configObject });
    });
});

app.post('/configure', addon.checkValidToken(), function (req, res) {
    Globlas_Clientkey = req.context.clientKey;
    let configObject = req.body;
    configObject.clientKey = req.context.clientKey;
    addon.settings.set('configuration', configObject, req.context.clientKey).then(() => {
        res.send(configObject);
    });
});

app.post('/GetRepositories', async function (req, res) {
    try {
        let Baseurl = req.query.xdm_e;
        let APIEndPoint = `/api/externalintegration/GetRepositories?EmailId=${req.body.userid}`;
        const APIResponse = await AsyncProlGetAPI(APIEndPoint, req.body, Baseurl, Globlas_Clientkey, 0);
        res.send(APIResponse);
    } catch (e) {
        console.error("Error occurred:", e);
        res.status(500).json({ error: 'An error occurred' });
    }
});

Concerns & Questions:

Global Variable Issue:

• The variable Globlas_Clientkey is declared globally, meaning it could be overwritten when multiple requests are processed concurrently.
• Is Globlas_Clientkey thread-safe in this scenario?

Accessing the Client Key in /GetRepositories API:

I am unable to access the correct clientKey inside the /GetRepositories API.

Since this API does not use addon.authenticate(), how can I reliably retrieve the correct clientKey for the requesting customer?

Best Practices:

What is the recommended approach for handling the clientKey in a multi-customer environment using atlassian-connect-express?

Are there library features that provide a reliable way to retrieve and manage the client key across API calls?

Request for Support:

• I would appreciate your insights on:
• Confirming whether my observations regarding the global variable causing issues are correct.
• Providing recommendations for handling the clientKey safely and efficiently.
• Suggesting best practices for ensuring reliable retrieval of the clientKey across all APIs in a multi-tenant environment.

Thank you for your assistance. I look forward to your response.

Best regards,

Prolaborate Team

[marc -Collabello--Phase Locked-]

Using the clientkey as a global variable is a security issue, and makes your app unsafe to use for multiple clients.  Just use addon.authenticate in your routes.

Also Connect is deprecated, and you won't be able to release such an app in the near future.