Itsy: A Free Pack for Writing Web Apps that Run in Coda

[Saulo_Vallory]

@Paul_Danyliuk

Personal values are still stored in a doc they only “hide” from the UI but not from the doc data. Think of those simply as a table on a hidden page.

That’s very disappointing! I was under the impression that “personal” meant “accesible by my user only”! That personal option is great opportunity for data leaks

@Paul_Danyliuk

There’s nothing preventing you from just grabbing another user’s data (e.g. their cookie) and using it as yours. There is really nothing that you could pass to an embed that another user couldn’t. There’s no in-memory controls to e.g. type in the password. You can, of course, have security within the web app itself (i.e. a separate sign in flow with a backend doing authentication)

Ohhh I see the confusion. When I mentioned cookies, I was referring to cookies created by the web app. But I realize now that makes no sense! lol I was pretty tired when I wrote that. That’s why it was confusing to you guess. The app inside the iframe has full control over the cookies and if the session cookie exists, you are logged in. No need to get Coda involved.

@Bill_French

The concern may be gone, but Coda has sealed off the ability of a Pack to use its local storage from hosting anything within or for the benefit of the document.

That’s VERY frustrating! And it also means that any new trick will also receive a counter measure and stop working.

Looks like I met, fell in love, and want to break up in less than a week!

I just sent a suggestion to at least remove the warning for “approved email domains”. That would be something to me

Here it is:

Allow admin approved domains in embed without warning

I understand the security concerns regarding the embed warnings for domains that are not supported by iframely. I believe that there should, at least, be an option to disable that for the domains set by the admin. I believe this is a low hanging fruit since Coda already has a mechanism for limiting the domains that can be approved that is used in workspace settings “Access” (shown below). [image]