Violating Content Security Policy when using Forge API

[Dmitry Khotinskiy]

I'm developing a module for Jira using Atlassian Forge and when I try to pull user's data using @Forge/api, I get the following error on Jira Cloud:

Refused to connect to 'https://jira/rest/api/3/myself' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.atlassian.com/metal/ingest".

Here's my code:

const accountInfoURL = route`/rest/api/3/myself`
const accountInfoRes = await api.asApp().requestJira(accountInfoURL, {
  headers: {
    'Accept': 'application/json'
  }
})

[Dave Rosenlund _Trundl_ · Accepted solution]

Welcome to the Atlassian Community, @Dmitry Khotinskiy  👋

Check out this post on the Atlassian Developer Community. It may provide some insight.

And, you may want to consider joining that Atlassian developer-specific community, too.

Best,

-dave

[Dmitry Khotinskiy]

Thank you @Dave Rosenlund _Trundl_, although that post didn't provide resolution to my issue, it led me to the answer. The code that I provided was in the frontend/index.jsx file which should be in resolver/index.js and accessed via @forge/bridge.

Also, thank for pointing me to Atlassian's developer-specific community!

[Huong Thi An]

Hi @Dmitry Khotinskiy ,

Can you tell me how to fix your issue?

[David Bakkers]

Hello @Dmitry Khotinskiy 

You are trying to get data about the currently logged in user, so you need to use the asUser() context method, not the as asApp() method:

await api.asUser().requestJira(route`/rest/api/3/myself`)

[Dmitry Khotinskiy]

Thank you for your response @David Bakkers, but both asUser() and asApp() produce the same issue.

[David Bakkers]

No problems. As you've already worked out, you can't call internal APIs from the frontend via the bridge.