fix: Phoenix LiveDashboard (#1878)

* Fixed an issue with socket connection.

* Adjusted some sockets.

* Tweaked socket.js.

* A test.

* Fixed npm issue.

* Another test.

* Added more specific origins.

* A test.

* Reverted some frontend changes. Don't think they're needed.

config/dev.exs

@@ -19,7 +19,8 @@ config :screens, ScreensWeb.Endpoint,
       "--watch",
       cd: Path.expand("../assets", __DIR__)
     ]
-  ]
+  ],
+  check_origin: false
 
 config :screens,
   default_api_v3_url: System.get_env("API_V3_URL", "https://api-v3.mbta.com/"),

config/prod.exs

@@ -12,7 +12,12 @@ import Config
 config :screens, ScreensWeb.Endpoint,
   url: [host: "example.com", port: 80],
   server: true,
-  cache_static_manifest: "priv/static/cache_manifest.json"
+  cache_static_manifest: "priv/static/cache_manifest.json",
+  check_origin: [
+    "https://screens.mbta.com",
+    "https://screens-dev.mbtace.com",
+    "https://screens-dev-green.mbtace.com"
+  ]
 
 # Do not print debug messages in production
 config :logger, level: :info

lib/screens_web/endpoint.ex

@@ -2,9 +2,17 @@ defmodule ScreensWeb.Endpoint do
   use Sentry.PlugCapture
   use Phoenix.Endpoint, otp_app: :screens
 
-  socket "/socket", ScreensWeb.UserSocket,
-    websocket: true,
-    longpoll: false
+  # The session will be stored in the cookie and signed,
+  # this means its contents can be read but not tampered with.
+  # Set :encryption_salt if you would also like to encrypt it.
+  @session_options [
+    store: :cookie,
+    key: "_screens_key",
+    signing_salt: "g3bAaGvf",
+    same_site: "Lax"
+  ]
+
+  socket "/live", Phoenix.LiveView.Socket, websocket: [connect_info: [session: @session_options]]
 
   # Serve at "/" the static files from "priv/static" directory.
   #
@@ -24,8 +32,6 @@ defmodule ScreensWeb.Endpoint do
     plug Phoenix.CodeReloader
   end
 
-  socket "/live", Phoenix.LiveView.Socket
-
   plug Phoenix.LiveDashboard.RequestLogger,
     param_key: "request_logger",
     cookie_key: "request_logger"
@@ -47,10 +53,7 @@ defmodule ScreensWeb.Endpoint do
   # The session will be stored in the cookie and signed,
   # this means its contents can be read but not tampered with.
   # Set :encryption_salt if you would also like to encrypt it.
-  plug Plug.Session,
-    store: :cookie,
-    key: "_screens_key",
-    signing_salt: "g3bAaGvf"
+  plug Plug.Session, @session_options
 
   plug ScreensWeb.Router
 end