Skip to content

[5.x] Fix live preview token scope#14304

Draft
jasonvarga wants to merge 2 commits into5.xfrom
fix-live-preview-auth
Draft

[5.x] Fix live preview token scope#14304
jasonvarga wants to merge 2 commits into5.xfrom
fix-live-preview-auth

Conversation

@jasonvarga
Copy link
Member

This PR makes sure that a live preview url/token can only be used for the entry that it was created for.

It also fixes the token expiry logic. If an expired token is used, it'll get deleted and return null. It won't wait for garbage collection.

jasonvarga and others added 2 commits March 19, 2026 22:42
Previously, expired tokens were only cleaned up by garbage collection
(2% chance per request). Now find() checks expiry and deletes expired
tokens immediately, ensuring they cannot be used after expiration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant