feat: add a trust project for live preview in phoenix iframe- browser only #1266
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Thank You for making this pull request. |
1 similar comment
Thank You for making this pull request. |
Thank You for making this pull request. |
abose
changed the title
|
Thank You for making this pull request. |
abose
changed the title
17 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Improve live preview safety.
In desktop builds, each project is securely sandboxed in its own live preview server:port domain.
This setup ensures security within the browser sandbox, eliminating the need for a trust confirmation dialog. We can display the live preview immediately.
In browsers, since all live previews for all projects uses the same
phcode.livedomain, untrusted projects can access data of past opened projects. So we have to show atrust project?dialog in live preview in browser.Future plans for browser versions include adopting a similar approach to dynamically generate URLs in the format
project-name.phcode.live. This will streamline the workflow by removing the current reliance on users to manually verify and trust each project in the browser.Other fixes
QuickViewManager.js:457 [Deprecation] Listener added for a synchronous 'DOMSubtreeModified' DOM Mutation Event. This event type is deprecated (https://w3c.github.io/uievents/#legacy-event-types) and work is underway to remove it from this browser. Usage of this event listener will cause performance issues today, and represents a risk of future incompatibility. Consider using MutationObserver instead.