Customer-managed egress

Smart Courses is now on Atlassian Forge. As part of this move, media, websites and SCORM content that pull from external links are no longer supported by default. Here’s what changed, what still works by default, and how to keep external domains working.

What changed

Smart Courses has migrated to Atlassian Forge, the platform Atlassian uses to build and host apps within your Atlassian environment. Forge gives your organization stronger control over how the app connects to the outside world, a benefit for security and compliance reviews. It does this by controlling egress, the app's ability to reach out to addresses on the public internet. An app running on Forge can only contact external domains that have been explicitly declared and approved.

As a result, any media or SCORM file that loads content from an external link will not display or play unless that link's domain has been approved. This affects images, audio, video, and other media referenced by a URL, as well as SCORM packages that fetch assets from an external source at runtime.

Default domains

Smart Courses ships with a default list of approved egress domains. This list includes the domains the app itself needs to keep running, and we've also kept a few external media sources that our customers use most often. Media served from any of these sources works out of the box, with no attachment upload and no administrator approval needed.

The following external media sources are approved by default:

If your media comes from one of these sources, it should load without any extra steps. Everything below applies only to media and SCORM content that links to a source outside this default list.

Upload your media as an attachment

For media files, we recommend the simplest and most reliable fix: upload the file directly as an attachment instead of linking to external sources. Attached files are stored within Atlassian storage, so they aren't subject to egress rules.

Manage app egress 

If uploading the external resource as an attachment isn't feasible, the alternative is customer-managed egress. This will be necessary for external web pages, SCORM files, and other media that must load from a link rather than a stored attachment. This Forge capability lets an administrator approve particular external domains, so the app is permitted to load content from them.

Approving egress is a site administrator action. When an administrator adds a domain, Atlassian shows a consent screen describing exactly what's being allowed.

Add links

Start by adding the main URL of the media. In many cases, approving that single domain is enough for the content to load. However, this depends on the source and the media type. Some media, and many SCORM packages, pull supporting assets from additional domains. When the main URL isn’t enough to load all resources, a site administrator will have to add each additional domain the media depends on before it works as expected.

Egress limits

Forge caps how much external egress a single installation can have, so you can't approve an unlimited number of links. Keep these limits in mind when deciding between attaching media and approving links, especially for courses that reference many external sources.