Sourced from @globus/static-data-portal's
releases.
v2.0.0
2.0.0 (2024-10-29)
⚠ BREAKING CHANGES
The portal will now store authorization tokens in memory (previously
localStorage) by default. This change underlines our commitment to providing a "secure by default" implementation.How is In-Memory Storage More Secure?
When using our GitHub Template Repository to create a portal, your portal is automatically configured to deploy to GitHub Pages. Without a custom domain configuration, your application will be deployed to
{username}.github.io/{repository-name}. Due to the same origin access policies oflocalStoragethis means any application you[^1] deploy to GitHub pages would have access to items placed inlocalStorageby the portal. We believe this default behavior is the less secure option and can lead to unexpected behavior based on your GitHub account usage.Explaining the Breaking Change
With this new default, the end-user experience around authorization will change to requiring users to authenticate when the portal's browser window is closed. Due to the nature of this change we have flagged this change as a "breaking change", resulting in a major version bump. While we do believe most users should update without making changes to their
static.jsonfile, we have included the ability to opt-in to the previous behavior of storing authorization information inlocalStorage. Before enabling this functionality, we recommend being aware of security best practices related tolocalStorage, using a custom domain for your portal to better lock down origin access, or having policies in place to avoid unintended access when using the default GitHub Pages domain.To opt out of this change, a new property in the
static.jsonhas been added to enablelocalStoragestorage of authorization data (data.attributes.features.useLocalStorage).{ "_static": { "generator": { "name": "@globus/static-data-portal" } }, "data": { "version": "1.0.0", "attributes": { "features": { "useLocalStorage": true } } } }[^1]:
localStorageis only available to applications on the same origin, which includes subdomain; Access is only shared with GitHub Pages applications or sites on the same account, not other GitHub account's deployments.Features
v1.12.0
1.12.0 (2024-10-25)
Features
... (truncated)
Sourced from @globus/static-data-portal's
changelog.
2.0.0 (2024-10-29)
⚠ BREAKING CHANGES
- Use in-memory based storage for authorization tokens, by default. (#347)
Features
1.12.0 (2024-10-25)
Features
Fixes
558d2e1
chore(main): release 2.0.0 (#348)b26f28c
test: Adds React Testing Library and Jest (#350)78dc5ca
docs: Update README.md4a3cae1
deps: bump the typescript-eslint group with 2 updates (#343)c6ac0f8
feat!: Use in-memory based storage for authorization tokens, by default.
(#347)5145990
deps: bump eslint-plugin-react from 7.37.1 to 7.37.2 (#344)d0a3e3d
deps: bump @tanstack/eslint-plugin-query from 5.59.4 to
5.59.7 (#345)ca7237e
deps: bump the react-query group with 2 updates (#340)7b5b406
deps: bump the typescript-eslint group with 2 updates (#338)12b4796
deps: bump the react group with 2 updates (#339)