Rotate Livewire release_token per deploy for cache-busting #26

New issue

Open

opened 2026-04-26 11:53:40 +02:00 by myrmidex · 0 comments

myrmidex commented

2026-04-26 11:53:40 +02:00

Owner

Context

config/livewire.php ships release_token => 'a' (Livewire's upstream default). This token is sent to clients and used to detect stale sessions after a deploy — when the token changes, Livewire prompts users to refresh. With a static token, the prompt never fires, so users on stale tabs hit cryptic Livewire errors after a deploy.

Acceptance

Edit config/livewire.php: 'release_token' => env('LIVEWIRE_RELEASE_TOKEN', 'a')
In docker/prod/start.sh, set LIVEWIRE_RELEASE_TOKEN from a build-time identifier (git SHA, image tag, or build timestamp). Pick whichever the prod build pipeline already exposes — IMAGE_TAG env var passed by Forgejo Actions is the cheapest if present.
Document the env var in the deploy README alongside APP_KEY, DB_*
Verify locally: tail Livewire's response headers and confirm the token differs between two builds

Notes

Falls back to 'a' in dev (no env var) — that's fine, dev users don't need cache-busting prompts.
Tied to deploy pipeline polish; reasonable to ship alongside other v0.2 deploy hardening.

## Context `config/livewire.php` ships `release_token => 'a'` (Livewire's upstream default). This token is sent to clients and used to detect stale sessions after a deploy — when the token changes, Livewire prompts users to refresh. With a static token, the prompt never fires, so users on stale tabs hit cryptic Livewire errors after a deploy. ## Acceptance - [ ] Edit `config/livewire.php`: `'release_token' => env('LIVEWIRE_RELEASE_TOKEN', 'a')` - [ ] In `docker/prod/start.sh`, set `LIVEWIRE_RELEASE_TOKEN` from a build-time identifier (git SHA, image tag, or build timestamp). Pick whichever the prod build pipeline already exposes — `IMAGE_TAG` env var passed by Forgejo Actions is the cheapest if present. - [ ] Document the env var in the deploy README alongside `APP_KEY`, `DB_*` - [ ] Verify locally: tail Livewire's response headers and confirm the token differs between two builds ## Notes - Falls back to `'a'` in dev (no env var) — that's fine, dev users don't need cache-busting prompts. - Tied to deploy pipeline polish; reasonable to ship alongside other v0.2 deploy hardening.