Bypassing view access control using direct link

When using the dash_app template tag, the contents are rendered in an iframe. A curious user can inspect the page source and get the direct link to the Dash app directly form the iframe. The direct link might allow the user to bypass access control and other precautions built into a project. This seems to undermine the view based access control:

Each view delegated through to plotly_dash can be wrapped using a view decoration function. This enables access to be restricted to logged-in user

How can we mitigate the risk of potential abuse, particularly when dashboards may contain sensitive data?

[GibbsConsulting]

@brylie The function supplied as the view_decorator should get called on every call that passes through django_plotly_dash, so you should not be able to subvert the access control by copying the link.

You can verify this by doing exactly as you describe - go to an app as an authorized user, grab one of the urls (the debugging console of your browser can help you do this), and then try to access that url as an unauthorized user.

[GibbsConsulting]

Just pulled #90 into master, which hopefully addresses this, and closing this issue. Please reopen with comments if the documentation can be improved.