Embeddable dashboard #812
Merged
Embeddable dashboard #812
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ukutaht
force-pushed
the
embeddable-dashboard
branch
from
83714e8
to
239b60b
Compare
Closed
Co-authored-by: aymanterra <aymanterra@users.noreply.github.com> Co-authored-by: Brad Kane <bradkane@users.noreply.github.com>
ukutaht
force-pushed
the
embeddable-dashboard
branch
from
d60d76d
to
ece4ead
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
New branch for embed mode based on #772. Mostly the same feature, thanks a lot @aymanterra @bradkane for your research and contributions on this. I'll see if I can add you as addition authors for the commit when I merge it.
The main change from the original PR is that the embed mode is done with no configuration or persistence on the server side. Shared links will always remove
X-Frame-Optionsheader and setSameSite: None; securefor cookies. This relaxed security is only applied to shared links, the rest of the application still uses secure browser headers and restricts cookie domain.Since shared links are read-only, and specifically meant for sharing stats outside of Plausible, I don't think it introduces any security issues. Happy to be convinced otherwise.
TODO:
transparentworks.EDIT: transparent backgound does work but the header looks a bit weird. Maybe transparent cannot work due to the sticky header we have.
I think this should be enough for a first release. We can add more elaborate external CSS theming in the future if there's demand.
Tests
Changelog
Documentation