Purpose of https://livebookusercontent.com/?

[clayscode]

For enabling HTTPs, why must Livebook connect to https://livebookusercontent.com/? Why can't the content be hosted locally like with http? Other than modifying the code, is there any way to disable this functionality?

EDIT: LIVEBOOK_IFRAME_URL - sets the URL that Livebook loads iframes from. By default iframes are loaded from local LIVEBOOK_IFRAME_PORT when accessing Livebook over http:// and from https://livebookusercontent.com/ when accessing over https://.

Ah, so you can override it by setting LIVEBOOK_IFRAME_URL. Still, I think this should be something that is opt-in rather than opt-out.

[josevalim]

We need this for cross-origin iframes, to limit the access of custom JS to Livebook. The issue is that for cross origin iframes over HTTPS, you need to host a page on a separate port over HTTPS, which you would have to provide. That’s hard to do by default. So we either provide a broken version over HTTPS or we go with the current approach. If you have alternatives in mind, please let us know.

[clayscode]

I see. Are there any guides on how to setup Livebook with HTTPS? More specifically, I'm trying to figure out how to deploy Livebook apps behind an authenticated proxy. LIVEBOOK_WITHIN_IFRAME seems like it might do what I want, but I'd like to set it up with my own domain/certs rather than forwarding my Livebook content to a remote server.

[josevalim]

It should just work, there is nothing special required except optionally setting LIVEBOOK_IFRAME_URL. LIVEBOOK_WITHIN_IFRAME is only required if you are running it inside an iframe.