[discuss] Don't store part of drilldown state in Dashboard URL? #67982
Labels
discuss
Feature:Dashboard
Dashboard related features
Feature:Drilldowns
Embeddable panel Drilldowns
Feature:Embedding
Embedding content via iFrame
Team:Visualizations
Visualization editors, elastic-charts and infrastructure
We are going to implement URL drilldown: #55324
Drilldown's configuration will contain a destination URL and we need to make sure dashboard app won't pick up random destination url from the dashboard url.
Option 1: Do not pick up drilldown destination url from dashboard URL
If we do this, how to not make user experience significantly worth?
Things we lose if remove part of state from URL:
Option 2: Rely on list of allowed domains
and do not change dashboard logic
We plan to implement allowed domains configuration.
Still under question if this should be opt-out or opt-in
This probably also related to: #59645, as visualization state will end up in the URL, and in case of markdown viz there could be urls.
The text was updated successfully, but these errors were encountered: