LiveView issue in my app: old tabs show a state that will allow them to make updates that shouldn’t be allowed

Phoenix Forum Questions / Help
,
1

Hi everyone! I’m having trouble figuring out a state bug I’m experiencing with LiveView. Does anyone have time to pair or suggestions on fixing this bug?

Summary:
If the tab has been open for a long time and the user returns to it, it shows an old state and will allow them to make updates that shouldn’t be allowed (e.g. a user completes the same sidequest twice so they get 2x the points for it).

Versions:
{:phoenix, “~> 1.6.10”},
{:phoenix_html, “~> 3.0”},
{:phoenix_live_reload, “~> 1.2”, only: :dev},
{:phoenix_live_view, “~> 0.17.7”},

2

Have you tried implementing form recovery? I had the same issue with incorrect state, so I had to store some extra hidden fields and made an extra function to handle the reconnect.

https://hexdocs.pm/phoenix_live_view/form-bindings.html#recovery-following-crashes-or-disconnects

2 Likes
3

I haven’t–this is super helpful. Thank you so much!

1 Like
4

also consider making this impossible in the application and/or DB layer - maybe some unique index or something…

2 Likes
5

+1 to @outlog . In general, client input should not be trusted.

2 Likes