# HTTP-caching LiveView's first render

**URL:** <https://forum.elixirforum.com/t/http-caching-liveviews-first-render/59180>\
**Category:** Questions\
**Tags:** phoenix, liveview, caching\
**Created:** [October 22, 2023, 9:08pm UTC](https://forum.elixirforum.com/t/http-caching-liveviews-first-render/59180 "2023-10-22T21:08:16Z")\
**Posts on this page:** 1\
**Showing post:** 13

<div class="post-metadata">

**Author:** ![tangui](https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/tangui/32/12091_2.png) [@tangui](https://forum.elixirforum.com/u/tangui)\
**Post date:** [September 2, 2024, 5:43pm UTC](https://forum.elixirforum.com/t/http-caching-liveviews-first-render/59180/13 "2024-09-02T17:43:28Z")

</div>

> [@LostKobrakai](#):
>
> The merged data is put on the html tags

> [@tangui](#):
>
> > [@LostKobrakai](#):
> >
> > LV doesn’t use any of the information stored in the cookie. The thing called session in the context of LV is the blobs of data scattered all over the html, not the data in the cookie. Cookies cannot be used securely over websockets afaik.
> 
> I think LV does use information in the session cookie to populate the session param, but only [after verifying the CSRF token is valid](https://github.com/phoenixframework/phoenix/blob/main/lib/phoenix/socket/transport.ex#L489-L503). As far as I understand, the WS session is established after a regular HTTP request, having an `upgrade: websocket` header. Cookies are sent along this HTTP request, and their content transmitted to the LiveView websocket session (unless there’s no valid CSRF token).

Unless I’m terribly wrong, this is not the case: only data set via the `:session` attribute of a `live_session` is stored in the HTML, and not the session data from the cookie. I have the feeling you assume the websocket connection doesn’t include the cookie, which is wrong - it does. Hence the CSWH issue discussed in the blog post.

Let’s check it out after setting 1) session cookie data 2) setting `live_session :default, session: %{"titi" => "toto"} do`:

Rendered HTML div root liveview:

```html
<div id="phx-F_F6hHTMdNAciQDC" data-phx-main data-phx-session="SFMyNTY.g2gDaAJhBXQAAAAIdwJpZG0AAAAUcGh4LUZfRjZoSFRNZE5BY2lRREN3B3Nlc3Npb250AAAAAW0AAAAEdGl0aW0AAAAEdG90b3cKcGFyZW50X3BpZHcDbmlsdwZyb3V0ZXJ3I0VsaXhpci5DYWNoZWFibGVMaXZldmlld3NXZWIuUm91dGVydwxsaXZlX3Nlc3Npb25oAncHZGVmYXVsdG4IAIiG5dqDevEXdwR2aWV3dytFbGl4aXIuQ2FjaGVhYmxlTGl2ZXZpZXdzV2ViLk1haW5MaXZlLkluZGV4dwlyb290X3ZpZXd3K0VsaXhpci5DYWNoZWFibGVMaXZldmlld3NXZWIuTWFpbkxpdmUuSW5kZXh3CHJvb3RfcGlkdwNuaWxuBgD5DpazkQFiAAFRgA.mhCxhz3RtfaIh7TRDV1I55h2Ra8h4o5060cFCL_x8RE" data-phx-static="SFMyNTY.g2gDaAJhBXQAAAADdwJpZG0AAAAUcGh4LUZfRjZoSFRNZE5BY2lRREN3BWZsYXNodAAAAAB3CmFzc2lnbl9uZXdqbgYA-g6Ws5EBYgABUYA.M75Zd_M-hrnOsnCrWy15ZFFKwzUJrwkJtX9dXg_iow4"><header class="relative top-0 right-0 left-0 p-1 bg-gray-100">

```

Decoding both values:

```elixir
iex(17)> data_phx_session |> String.split(".") |> Enum.map(&Base.url_decode64!(&1, padding: false)) |> Enum.drop(1) |> Enum.take(1) |> Enum.map(&:erlang.binary_to_term/1)
[
  {{5,
    %{
      id: "phx-F_F6hHTMdNAciQDC",
      session: %{"titi" => "toto"},
      parent_pid: nil,
      router: CacheableLiveviewsWeb.Router,
      live_session: {:default, 1725294838991390344},
      view: CacheableLiveviewsWeb.MainLive.Index,
      root_view: CacheableLiveviewsWeb.MainLive.Index,
      root_pid: nil
    }}, 1725294841593, 86400}
]
iex(18)> data_phx_static |> String.split(".") |> Enum.map(&Base.url_decode64!(&1, padding: false)) |> Enum.drop(1) |> Enum.take(1) |> Enum.map(&:erlang.binary_to_term/1)
[
  {{5, %{id: "phx-F_F6hHTMdNAciQDC", flash: %{}, assign_new: []}},
   1725294841594, 86400}
]

```

There’s no trace of session (cookie) data, only the values set by the `:session` option of the live session.

---

_[View the full topic](https://forum.elixirforum.com/t/http-caching-liveviews-first-render/59180)._