Information about security tokens used for loading external images in email messages sent out by Jira
プラットフォームについて: Data Center のみ - この記事は、Data Center プラットフォームのアトラシアン製品にのみ適用されます。
この KB は Data Center バージョンの製品用に作成されています。Data Center 固有ではない機能の Data Center KB は、製品のサーバー バージョンでも動作する可能性はありますが、テストは行われていません。サーバー*製品のサポートは 2024 年 2 月 15 日に終了しました。サーバー製品を利用している場合は、アトラシアンのサーバー製品のサポート終了のお知らせページにて移行オプションをご確認ください。
*Fisheye および Crucible は除く
全般的な情報
Starting with Jira Software 8.15 and Jira Service Management 4.15, email messages being sent out will contain links to external images that have security tokens in them. This allows any recipient of an email message to load images remotely, which will be used by email clients to display images as embedded images in the email content body.
These security tokens have the following features:
- Tokens are JWT and rely on Personal Access Tokens feature of Jira.
- Tokens are valid for 7 days by default.
- A new token will be generated for each user-attachment pair.
- Tokens allow access to a particular image on behalf of a particular user and do not allow anything else.
Any recipient of an email message will be able to see external images in it until token expiration date, and that includes all future recipients if the message gets forwarded.
Disabling external images loading
To disable this behavior, the following options exist:
- Disabling Personal Access Tokens system wide will disable all embedded images loading.
- Disable email images security tokens only (see below)
Disabling security tokens for emails
Where: Administration → System → General Configuration → Advanced Settings
Key: jira.security.image.attachment.jwt.tokens.expiry.hours
Description: Adds a security token to every image attachment displayed in email notifications. This allows users to view images in their notifications within the expiry time, which is 168 hours (7 days) by default. Setting it to 0 disables the tokens, but users won’t see images at all.