Forms: Use JWT for passing the Contact_Form object around by enejb · Pull Request #44360 · Automattic/jetpack

enejb · 2025-07-17T20:42:30Z

This PR fixes the an issue where forms that are placed inside form different templates and don't get processed as expected.

Fixes FORMS-109

In future PRs we want to remove the non JWT token way of sumitting the form. But we are keeping it still this way so that we don't cause any mid deploy failures.

Proposed changes:

Add methods for creating a forms instance via jwt string. (encoding and decoding)
Refactors the contact form submission handler to be able to reconstruct the form instance from the JWT (jetpack_contact_form_jwt) provided in the POST data.

Other information:

Have you written new tests for your changes, if applicable?
Have you checked the E2E test CI results, and verified that your changes do not break them?
Have you tested your changes on WordPress.com, if applicable (if so, you'll see a generated comment below with a script to run)?

Jetpack product discussion

Does this pull request change what data or activity we track or use?

No

Testing instructions:

Add a form. Does it submit as expected?
Add a form in a widget. Does it submit as expected?

github-actions · 2025-07-17T20:43:21Z

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack), and enable the update/add-jwt-form-encode-decode branch.
To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack update/add-jwt-form-encode-decode

Interested in more tips and information?

In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
Read more about our development workflow here: PCYsg-eg0-p2
Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

Copilot

Pull Request Overview

This PR implements JWT-based form submission to fix issues where forms placed in different templates don't get processed as expected. The implementation adds JWT encoding/decoding capabilities to the Contact_Form class while maintaining backward compatibility with the existing submission method.

Adds JWT encoding/decoding methods to Contact_Form class for form instance reconstruction
Includes a hidden JWT field in form HTML output for submission processing
Updates form submission handler to prioritize JWT-based form reconstruction over the existing hash-based method

Reviewed Changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
class-contact-form.php	Adds JWT encoding/decoding methods and includes JWT token in form output
class-contact-form-plugin.php	Updates submission handler to reconstruct forms from JWT token
Contact_Form_Test.php	Adds comprehensive test for JWT encoding/decoding functionality
composer.json	Adds jetpack-jwt package dependency
changelog files	Documents the changes for both plugin and package

projects/packages/forms/changelog/update-add-jwt-form-encode-decode

projects/packages/forms/src/contact-form/class-contact-form.php

github-actions · 2025-07-17T20:43:36Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add a "[Status]" label (In Progress, Needs Review, ...).
✅ Add a "[Type]" label (Bug, Enhancement, Janitorial, Task).
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

Follow this PR Review Process:

Ensure all required checks appearing at the bottom of this PR are passing.
Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
You can use GitHub's Reviewers functionality to request a review.
When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

Jetpack plugin:

The Jetpack plugin has different release cadences depending on the platform:

WordPress.com Simple releases happen as soon as you deploy your changes after merging this PR (PCYsg-Jjm-p2).
WoA releases happen weekly.
Releases to self-hosted sites happen monthly:
- Scheduled release: August 5, 2025
- Code freeze: August 4, 2025

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

jp-launch-control · 2025-07-17T20:51:39Z

Code Coverage Summary

Coverage changed in 2 files.

File	Coverage	Δ%	Δ Uncovered
projects/packages/forms/src/contact-form/class-contact-form.php	613/1085 (56.50%)	0.72%	1 ❤️‍🩹
projects/packages/forms/src/contact-form/class-contact-form-plugin.php	449/1185 (37.89%)	1.96%	-20 💚

Full summary · PHP report · JS report

Introduces JWT-based serialization and deserialization for contact form instances, enabling forms to be securely encoded and restored via a hidden JWT field. Updates include new methods in Contact_Form, changes to form rendering and processing, dependency on automattic/jetpack-jwt, and corresponding unit tests.

…ecode Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Introduces a has_verified_jwt property to the Contact_Form class to indicate JWT verification status. Updates form creation and submission logic to bypass certain ID checks when a verified JWT is present, improving security and flexibility for authenticated form submissions.

simison · 2025-07-18T09:33:39Z

This might also resolve this issue?

Forms: required form fields allow empty submission #43028

Forms with required fields were able to submit as empty when placed in templates.

CGastrell · 2025-07-18T14:26:20Z

This might also resolve this issue?

Forms: required form fields allow empty submission #43028

Forms with required fields were able to submit as empty when placed in templates.

Seems like there's an issue with the interactivity API context picking up corrupt values (OB output?)

CGastrell

All works perfectly! Tested on widgets and template parts, all smooth.

That said, I did push a phan update baseline to fix that check, but there are other checks not going through because some of the libs require php 8.3

Unsure what we should do with that

simison · 2025-07-18T14:39:16Z

[...] but there are other checks not going through because some of the libs require php 8.3
Unsure what we should do with that

cc @Automattic/jetpack-monorepo for advice

tbradsha · 2025-07-18T16:00:53Z

The composer lockfile was generated on PHP 8.3+, and the CI expects PHP 8.2 at the moment, so the fix is to run it with PHP 8.2, as done here: 1d87130

CGastrell

Works nicely! Let's ship this on Monday!

…4360)" This reverts commit fa03729.

…4360)" (#44397) This reverts commit fa03729.

* Changelog and readme.txt edits. * Release packages that depend on status package * Revert "Forms: Use JWT for passing the Contact_Form object around (#44360)" (#44397) This reverts commit fa03729. * Release packages/forms 4.0.1 * Version bumps --------- Co-authored-by: Enej Bajgoric <enej.bajgoric@automattic.com>

enejb requested review from CGastrell, Copilot and lezama July 17, 2025 20:42

enejb added Bug When a feature is broken and / or not performing as intended [Status] Needs Review This PR is ready for review. [Package] Forms labels Jul 17, 2025

Copilot AI reviewed Jul 17, 2025

View reviewed changes

github-actions bot added [Feature] Forms [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ [Tests] Includes Tests labels Jul 17, 2025

enejb changed the title ~~Update/add jwt form encode decode~~ Forms: Use jwt for passing the Contact_Form object around Jul 17, 2025

enejb changed the title ~~Forms: Use jwt for passing the Contact_Form object around~~ Forms: Use JWT for passing the Contact_Form object around Jul 17, 2025

enejb and others added 8 commits July 17, 2025 16:14

changelog

fb767d5

Update projects/packages/forms/changelog/update-add-jwt-form-encode-d…

353b692

…ecode Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update projects/packages/forms/src/contact-form/class-contact-form.php

e2a34d0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update projects/packages/forms/src/contact-form/class-contact-form.php

a86363d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Add a default secret

728bee3

End early if we don't have a valid Token

b6989f0

Improve tests

63f849c

enejb force-pushed the update/add-jwt-form-encode-decode branch from a8757b2 to 63f849c Compare July 17, 2025 23:15

enejb added 4 commits July 17, 2025 16:38

Remove the store_shortcode since we don't need it any more.

a1f4b53

Update lock file

b8160e3

Deprecate the method

9f6f01b

update phan baseline

21dc49d

CGastrell reviewed Jul 18, 2025

View reviewed changes

enejb mentioned this pull request Jul 18, 2025

Forms: Refactor to Use JWT for Form Reconstruction #43669

Closed

3 tasks

CGastrell and others added 2 commits July 18, 2025 12:38

update lock file

1d87130

Add test

701b81f

add more tests

287e12c

CGastrell self-requested a review July 18, 2025 20:12

CGastrell approved these changes Jul 18, 2025

View reviewed changes

CGastrell merged commit fa03729 into trunk Jul 21, 2025
67 checks passed

CGastrell deleted the update/add-jwt-form-encode-decode branch July 21, 2025 13:37

github-actions bot added this to the jetpack/14.9 milestone Jul 21, 2025

github-actions bot removed the [Status] Needs Review This PR is ready for review. label Jul 21, 2025

enejb added a commit that referenced this pull request Jul 21, 2025

Revert "Forms: Use JWT for passing the Contact_Form object around (#4…

5351c15

…4360)" This reverts commit fa03729.

enejb mentioned this pull request Jul 21, 2025

Revert "Forms: Use JWT for passing the Contact_Form object around" #44397

Merged

enejb added a commit that referenced this pull request Jul 21, 2025

Revert "Forms: Use JWT for passing the Contact_Form object around (#4…

4f2e72b

…4360)" (#44397) This reverts commit fa03729.

tbradsha pushed a commit that referenced this pull request Jul 21, 2025

Revert "Forms: Use JWT for passing the Contact_Form object around (#4…

4c5c0e3

…4360)" (#44397) This reverts commit fa03729.

enejb mentioned this pull request Jul 21, 2025

Forms: Use JWT for passing the Contact_Form object around - Try 2 #44399

Merged

nani-samireddy mentioned this pull request Aug 11, 2025

Jetpack Form Submission Issue on GoDAM Video Block rtCamp/godam#873

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Forms: Use JWT for passing the Contact_Form object around#44360

Forms: Use JWT for passing the Contact_Form object around#44360
CGastrell merged 16 commits intotrunkfrom
update/add-jwt-form-encode-decode

enejb commented Jul 17, 2025

Uh oh!

github-actions bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

jp-launch-control bot commented Jul 17, 2025 •

edited

Loading

Uh oh!

simison commented Jul 18, 2025 •

edited

Loading

Uh oh!

CGastrell commented Jul 18, 2025

Uh oh!

CGastrell left a comment

Uh oh!

simison commented Jul 18, 2025 •

edited

Loading

Uh oh!

tbradsha commented Jul 18, 2025

Uh oh!

CGastrell left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

enejb commented Jul 17, 2025

Proposed changes:

Other information:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

Uh oh!

github-actions bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jp-launch-control bot commented Jul 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

simison commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CGastrell commented Jul 18, 2025

Uh oh!

CGastrell left a comment

Choose a reason for hiding this comment

Uh oh!

simison commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tbradsha commented Jul 18, 2025

Uh oh!

CGastrell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

github-actions bot commented Jul 17, 2025 •

edited

Loading

github-actions bot commented Jul 17, 2025 •

edited

Loading

jp-launch-control bot commented Jul 17, 2025 •

edited

Loading

simison commented Jul 18, 2025 •

edited

Loading

simison commented Jul 18, 2025 •

edited

Loading