Atlassian Companion security issues

[Robert007]

Our security team has checked the new tool "Atlassian Companion" before they will be roll out the new tool to all our PCs. Before release of the tool they have some questions about technical details:

• How can the tool "Atlassian Companion" prohibit the communication with others software products except Confluence in the browser ?? It must not happen that other products can read the confluence data.
• Our security team told me, that the "Atlassian Companion" App is a Web-Server (or something like that) which communicate with the "https" protocol. So our team want to know, which certificate is used by the tool ?? Or is used a "private key" for checking the requests ?

Here are some information about our infrastructure:

OS Server: Debian 8
Confluence Server version: 6.11.0
Atlassian Companion:  0.5.3
OS client: Windows 10

I hope, you can answer my questions.

Kindly regards

Robert

[Will Masters · Accepted solution]

Hi Robert,

The Companion App connects to your Confluence instance through your browser using a secure WebSocket connection. It also is necessary to make a “trusted” link with your instance for it to be able to communicate. For this to occur the Companion app must also be able to connect to your localhost address, if this is blocked for any reason on your machine Confluence will not recognise the presence of the Companion app. 

Once the secure WebSocket connection to the web browser is established and you have “trusted” the Companion app to connect to your server instance the app requests the file via the existing Confluence rest api interface and this local file is opened with the application you wish to use. Only the Companion app has the ability to do this.

You can read some more about the details in the following KB:

Administering the Atlassian Companion App

Kind regards,

Will.