diff options
Diffstat (limited to 'app/controllers/jira_connect/application_controller.rb')
| -rw-r--r-- | app/controllers/jira_connect/application_controller.rb | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/app/controllers/jira_connect/application_controller.rb b/app/controllers/jira_connect/application_controller.rb index 352e78d6255..9b3bff062dd 100644 --- a/app/controllers/jira_connect/application_controller.rb +++ b/app/controllers/jira_connect/application_controller.rb @@ -22,6 +22,8 @@ class JiraConnect::ApplicationController < ApplicationController def verify_qsh_claim! payload, _ = decode_auth_token! + return if request.format.json? && payload['qsh'] == 'context-qsh' + # Make sure `qsh` claim matches the current request render_403 unless payload['qsh'] == Atlassian::Jwt.create_query_string_hash(request.url, request.method, jira_connect_base_url) rescue StandardError |