Recent searches
No recent searches

Nate Cartwright
Joined Apr 16, 2021
·
Last activity Aug 16, 2022
Following
0
Followers
0
Total activity
7
Votes
0
Subscriptions
3
ACTIVITY OVERVIEW
BADGES
ARTICLES
POSTS
COMMUNITY COMMENTS
ARTICLE COMMENTS
ACTIVITY OVERVIEW
Latest activity by Nate Cartwright
Nate Cartwright commented,
Hi Sebastian,
According to the ZAF2 client.request() documention, it seems that setting cors: true in the settings should make the request come from the browser, not the proxy service (which doesn't support binary files) and include the authorization header. I am actually requesting a text file attachment in these cases (application/ics or text/calendar .ics files). However, that seems to just be broken, though, when cors: true is set it is not including the Authorization Header for requests to those URLs, because they are actually redirected URLs. I would suspect this is due to some whitelisting, as the documentation for client.request() states "Requests to Zendesk APIs are always made from the browser, regardless of this option." But the URL I am requesting is a request to a Zendesk.com domain, but that is being redirected to the actual URL, which is causing the CORS issue. Thus, a missing Authorization Header here seems like more of a bug/oversight of the request() method.
The issue is definitely that the Authorization Header is not being sent, and is required when fetching attachments, as per: https://support.zendesk.com/hc/en-us/community/posts/4411831431450-Download-the-Zendesk-ticket-attachment-via-API
So the ZAF2 framework handles the Authorization Header token for me, so I should be able to retrieve it somehow, in order to inject into the headers of a native AJAX call?
If this isn't possible, where do I request this feature? Seems like this should be an easy method to add to the ZAFClient. client.getAuthorizationHeader().
I did find a post with this exact issue, and it is simply that the Authorization Header needs to be supplied, but I don't see how to pull that within a ZAF2 app.
I could setup my own OAUTH2, but that seems silly when the ZAF2 client already has all that. Doing it with a custom OAUTH2 setup would require me to have a separate server to authenticate the OAUTH2 client to, which kind of defeats the purpose of using a ZAF2 app.
As per https://developer.zendesk.com/documentation/ticketing/using-the-zendesk-api/making-cross-origin-browser-side-api-requests/ the ZAF client should be used when you need to transparently handle the OAUTH2 authorization token, but it doesn't support fetching binary files. So I need a method to retrieve the Authorization Header token from the ZAF client somehow, and I don't see how I can do that.
Here's the post speaking about doing this, but the "use OAUTH" solution would only work when the request comes from outside Zendesk ZAF2: https://support.zendesk.com/hc/en-us/community/posts/4411831431450-Download-the-Zendesk-ticket-attachment-via-API
View comment · Edited Aug 16, 2022 · Nate Cartwright
0
Followers
0
Votes
0
Comments
Nate Cartwright created a post,
I'm developing an iCalendar / calendar invite Zendesk Apps Framework app, and running into issues grabbing calendar invite attachments in Zendesk support tickets.
I'm trying to request attachments using the ZAF client. As per the docs here, it says CORS can be added to the ZAFClient.request() method by specifying cors: true or cors:false in the headers, as per:
However, that doesn't make much sense as it's the response that should have the CORS information for the browser, not the request.
It doesn't look like the attachments endpoint actually has the content for the attachment. The actual attachment is a Redirect from .zendesk.com/attachments/token/ to a asset store at https://p20.zdusercontent.com/attachment/. This is thus technically a cross-site request.
There appears to be only a single other thread about this, here: https://support.zendesk.com/hc/en-us/community/posts/4408861005722-CORS-error-when-fetch-internal-attachment-using-attachment-contentUrl and it just has a generic link back to the CORS information page.
As per the helpdesk article here: https://support.zendesk.com/hc/en-us/articles/4408881672730 it says the ZAF Client .request() method should actually be used in order to avoid CORS issues, since it acts as a proxy (thus avoiding the browser's CORS checking). It says it does not support binary files, though I am trying to pull text attachments, though that may not matter to it.
Posted Aug 16, 2022 · Nate Cartwright
0
Followers
5
Votes
4
Comments
Nate Cartwright commented,
We have not "upgraded" to this new feature, but this week all our cc agent addresses are going out to all our clients, exposing our internal email addresses to them. This invariably means clients start emailing individual agents because their email and name is now in their email system. There is *no* way to delete an email or name from Gmail once it's added, even if you remove the contact the autocomplete is still there. Zendesk has now changed this functionality of CCs to put the private email address of *every* agent we have in the group publicly cc'd on every ticket we have. This is atrocious. Please do not automatically CC agents when a ticket is assigned to their group, and bring back the setting to not display cc'd parties in the CC field of the email (instead they should be able to be listed as CC'd in the email template, if desired).
We have now lost a bunch of tickets because users now have *every agent in the company's personal email address* in their Gmail contact list, without our consent.
Finally, please do *not* automatically add CCs to a ticket just because there is a trigger that emails an agent or a group of agents about a ticket. If we wanted to add a CC to a ticket in a trigger, we would do that explicitly in the trigger. This recent change is what has caused *all* our agents to be CCed on *every* ticket in their group, because we send out notification triggers for each ticket (but do *not* add them to the ticket's CCs, on purpose, but Zendesk is adding them, apparently because of this notification trigger).
You might say "well just switch to the new CCs and followers function", but this horribly breaks our "if requestor is not current user" trigger filter, which prevents agents from getting spammed by their own updates.
View comment · Posted Jul 29, 2021 · Nate Cartwright
0
Followers
2
Votes
0
Comments
Nate Cartwright commented,
What's even worse, is that the suspended tickets pattern matching is pretty terrible, with *no* way to adjust it, even for the benign "system user" detection. For example, if someone forwards or replies to a standard email Non-Delivery-Receipt (NDR), the subject will be prepended with "FW:" or "RE:" as usual, but there's no way to tell Zendesk these are legitimate emails NOT from a system user, even though it's obvious the email isn't from a system user, because the FROM: and SENDER: fields are not a generic account like noreply@ or postmaster@. Instead, Zendesk appears to just look for the words "Non delivery" in the subject line, and suspends the ticket.
Thus, for anyone who is using Zendesk as a helpdesk, none of your users can forward any broken emails or system-generated emails into Zendesk without them being captured by the suspended tickets.
On top of this travesty, the "digest" emails for Suspended tickets don't actually have the subject of the suspended ticket in the subject line, so you have to dig through these.
Every spam filtering system I've ever used (and as a sysadmin I've used a lot) has at at least basic options to whitelist email addresses, domains, or subject lines, yet the Suspended tickets has none of this.
Finally, all of this would be superfluous with a simple change to simply disable notification emails being emitted for any tickets marked as suspended, but leaving them available as normal tickets in the normal zendesk views. This would allow people to customize their zendesk views to filter out "suspended" tickets from their views if they want, or allow them to see the suspended tickets in their views (so they don't miss them), but would avoid any ticket loops by having the email notifications disabled for the suspended tickets until they are unsuspended.
View comment · Posted Jun 05, 2020 · Nate Cartwright
0
Followers
2
Votes
0
Comments