VPN and firewalls

If your Jira instance is not accessible on the public internet, users will need to connect their device to your network or virtual private network (VPN) in order to use the app.

We recommend providing your users with step-by-step instructions on how to connect to your VPN when you let them know the mobile app is available, as this is something Atlassian Support will not be able to help them with.

SSL

The app accepts both HTTP and HTTPS connections.

If your Jira instance is configured to use SSL, you will not be able to log in on the app if:

• your certificate is self-signed and hasn't been installed on the device
  
  

• the Certificate Authority (CA) is unknown, or is not one that Android / iOS trusts by default (for example it might be a new CA that is not yet trusted, or a private CA)

• your certificate is missing an intermediate CA, affecting the certificate chain

• your certificate doesn't meet Apple's Requirements for trusted certificates in iOS 13 (affects people using the app on iOS devices).

See our Knowledge base article for information on how to resolve this.

Storage and encryption

The iOS and Android apps cache some content (issues, projects, boards) locally on the device. This helps keep the app responsive when navigating around projects and issues. We don't use any application-level encryption when storing cached data, but the device's internal storage may be encrypted by the operating system.  

When a user logs out, all cached data is deleted. 

We don't store passwords in the app. Instead we use session cookies, which are encrypted by default. 

Login and authentication

The app supports all common Jira user management configurations, including external user directories and SAML single sign-on (NTLM method isn't supported, only basic). Users will need to sign in to use the app, even if your site allows anonymous access.

The app uses an RFC-compliant user-agent header for making the requests during login. This allows us to effectively identify the app and apply further processing based on the user’s hardware and software.

Given the wide variety of supported configurations we decided to adopt the most versatile format. For both iOS and Android we compose the User-Agent header value by concatenating the standard WebView User-Agent and unique app identifier.

iOS User-Agent

Mozilla/5.0 (<system-information>) <platform> (<platform-details>) Safari/<technical-version> AtlassianMobileApp

Mozilla/5.0 (iPhone; CPU iPhone OS 14_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari/604.1 AtlassianMobileApp

Android User-Agent

Mozilla/5.0 (<system-information>) <platform> (<platform-details>) AtlassianMobileApp

Mozilla/5.0 (Linux; Android 9; Mi A1 Build/PKQ1.180917.001) AppleWebKit/537.36 (KHTML, like Gecko) AtlassianMobileApp

These headers are used in iOS app version 1.27.0 and Android app version 0.21.6 and later.

Mobile Device Management (MDM)

You can distribute the Jira Data Center and Server app to people in your organisation using your MDM solution. For more info on how to do this, see Mobile Device Management.

Third party add-ons and visual customizations

The mobile app provides a simple, lightweight way for users to view, create, edit and collaborate on issues. Complex interactions, including those provided by add-ons, will not be available in the app.

Any look and feel customizations you’ve made to your Jira instance will not be reflected in the app.

The Jira Server mobile app can push notifications directly to users' devices. Users choose whether they'd like to receive push notifications from the app, and can opt out at any time. This feature uses a cloud-based notifications service developed and maintained by Atlassian and hosted on our AWS infrastructure. No user or message content is sent to the service, only notification IDs, and we don't store any data.

• If you need to avoid using any cloud-based services you can choose to disable push notifications entirely. Head to Administration > System > Jira mobile app.
• If you're using restrictive firewall or proxy server settings, you'll need to allow (whitelist)  https://mobile-server-push-notification.atlassian.com  to ensure push notifications work as expected.

For sites that are not accessible on the public internet (for example users need to be connected via VPN to use the app) we adapt the push notification message as follows:

• If the user is connected to your network or VPN, we'll show the full notification, for example "Sara Leung shared 'End of year party' with you"
• If the user is not currently connected to your network or VPN, we'll show a shorter notification, for example "1 new notification".

For more info about push notifications, see Push notifications.

Mobile apps rely only on the 401 response status code to recognize a session timeout event. If your environment has a proxy, make sure that it doesn’t override the response status code (e.g. in case of ADFS you may run into a redirect to login.microsoft.com, a 3xx status code, when your session expires). Otherwise, you might see errors like No connection or Can't show the issue/page when your session expires and should log in again explicitly to resolve them.