Describe how to secure embedded component

[denis-anisimov]

Fixes flow#5005

---

This change is 

[ujoni]

Reviewed 5 of 5 files at r1.
Reviewable status: 13 unresolved discussions, 0 of 1 LGTMs obtained (waiting on @denis-anisimov)

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 13 at r1 (raw file):

To be able to do that you may use embedded web component properties.

This reads as "embedded **** properties".

"To be able to do that, use properties of the embedded web component.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 15 at r1 (raw file):

web component properties.

Note that the web component will be instantiated anyway regardless of 

The word "anyway" is not needed here.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 16 at r1 (raw file):

Note that the web component will be instantiated anyway regardless of 
restricted access since you may check the property value only when it's 

I think we should aim for passive person, when describing code functionality, so
"-- restricted access since the property value can only be checked when --"

also, avoid contractions in technical text: "it's" -> "it is".

Please slap me, when I do this. I tend to forget.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 19 at r1 (raw file):

updated from the client side in your listener on the server side. It means 
that you should avoid initialization of your component with a sensible data
in its constructor.

Sentence can be reduced:
"It means that you should avoid initialization of your component with a sensible data in its constructor."
->
"It means that you should avoid sensitive data in the component's constructor." (The use won't have a way to avoid initialization, so I don't think it needs to be mentioned here)

"sensible" -> "sensitive"

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 22 at r1 (raw file):

Here is an example how to set a property from the embedding page and
check it inside the embedded application:

We are talking about "embedded application" and "embedded web component" interchangeably in the text (probably in the others, too). Should we pick one and use it exclusively, at least in this tutorial?

I think "embedded application" is the one to go with.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 53 at r1 (raw file):

----

Here is the element `my-comp` is embedded into the static page and the `token` 

"Here is the element" -> "Here the element"

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 54 at r1 (raw file):

Here is the element `my-comp` is embedded into the static page and the `token` 
property is set from a JS function which retrieves it somehow within `login` 

We should probably open "JS" to "JavaScript"

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 91 at r1 (raw file):

    public EmbeddedComponent() {
        // Don't retrieve any sensible data here without granted access

"sensible" -> "sensitive"

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 103 at r1 (raw file):

The embedded web component will be instantiated before the exporter instance
receives the token value and you should not retrieve
/initialize the component with any sensible data in its constructor.

"sensible" -> "sensitive"

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 107 at r1 (raw file):

[NOTE]
It might be that you don't have a control over embedding web component to 

For consistence: "don't" -> "do not"

---

documentation/src/main/html/EmbeddedSecurity.html, line 26 at r1 (raw file):

  <my-comp id="embedded-web-component"></my-comp>

</body>

new line

---

documentation/src/main/java/com/vaadin/flow/tutorial/embeddingflowapplications/EmbeddedComponent.java, line 17 at r1 (raw file):

        // Initialize your secured component here
    }
}

new line

---

documentation/src/main/java/com/vaadin/flow/tutorial/embeddingflowapplications/EmbeddedComponentExporter.java, line 33 at r1 (raw file):

    }

}

new line

[denis-anisimov]

Reviewable status: 13 unresolved discussions, 0 of 1 LGTMs obtained (waiting on @ujoni)

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 13 at r1 (raw file):

Previously, ujoni (Joni) wrote…

To be able to do that you may use embedded web component properties.

This reads as "embedded **** properties".

"To be able to do that, use properties of the embedded web component.

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 15 at r1 (raw file):

Previously, ujoni (Joni) wrote…

The word "anyway" is not needed here.

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 16 at r1 (raw file):

Previously, ujoni (Joni) wrote…

I think we should aim for passive person, when describing code functionality, so
"-- restricted access since the property value can only be checked when --"

also, avoid contractions in technical text: "it's" -> "it is".

Please slap me, when I do this. I tend to forget.

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 19 at r1 (raw file):

Previously, ujoni (Joni) wrote…

Sentence can be reduced:
"It means that you should avoid initialization of your component with a sensible data in its constructor."
->
"It means that you should avoid sensitive data in the component's constructor." (The use won't have a way to avoid initialization, so I don't think it needs to be mentioned here)

"sensible" -> "sensitive"

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 22 at r1 (raw file):

embedded application

Hm....
embedded application is user here.
The problem is :

• there are properties for embedded application
• it's not possible to instantiate it.

Here in this tutorial the embedded component is used only when some instance in the context.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 53 at r1 (raw file):

Previously, ujoni (Joni) wrote…

"Here is the element" -> "Here the element"

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 54 at r1 (raw file):

Previously, ujoni (Joni) wrote…

We should probably open "JS" to "JavaScript"

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 91 at r1 (raw file):

Previously, ujoni (Joni) wrote…

"sensible" -> "sensitive"

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 103 at r1 (raw file):

Previously, ujoni (Joni) wrote…

"sensible" -> "sensitive"

Done.

---

documentation/embedding-flow-applications/tutorial-webcomponent-security.asciidoc, line 107 at r1 (raw file):

Previously, ujoni (Joni) wrote…

For consistence: "don't" -> "do not"

Done.

---

documentation/src/main/html/EmbeddedSecurity.html, line 26 at r1 (raw file):

Previously, ujoni (Joni) wrote…

new line

Done.

---

documentation/src/main/java/com/vaadin/flow/tutorial/embeddingflowapplications/EmbeddedComponent.java, line 17 at r1 (raw file):

Previously, ujoni (Joni) wrote…

new line

Done.

---

documentation/src/main/java/com/vaadin/flow/tutorial/embeddingflowapplications/EmbeddedComponentExporter.java, line 33 at r1 (raw file):

Previously, ujoni (Joni) wrote…

new line

Done.

[ujoni]

Reviewed 4 of 4 files at r2.
Reviewable status: complete! all discussions resolved, 1 of 1 LGTMs obtained