LiveView Websocket Security

So, it would be unwise to have live routes behind this pipeline then?

scope “/”, MyAppWeb do
pipe_through [:browser, :visitor, :redirect_if_user_is_authenticated]

live "/user/register", UserNewLive

Using the route helpers is better because:

1. you validate the route actually exists in your app.
2. if you change the url, you don’t have to change the code

That said, this will just work too: <%= link "Logout", to: Routes.user_session_path(@socket, :delete), method: :delete %>.

After read the docs about links , I’ve changed the template and now no need to pass @conn:
<li><%= link "Logout", to: "/users/logout", method: :delete %></li>
But I still misunderstand why the default template _user_menu.html.eex in mix phx.gen.auth use @conn at: <%= link "Logout", to: Routes.user_session_path(@conn, :delete), method: :delete %>

Btw, I got the worth information at the commit Add security considerations section to docs.

You should be able to generate the url just fine with both a conn or a socket. It just can’t be a live_patch or phx-click action, but it must be a proper http call to the server to log the user out.

Thank for your instant feedback, but the current logout link in template is:
<%= link "Logout", to: Routes.user_session_path(@conn, :delete), method: :delete %>

Then could we put the @conn to session at the login (as the usual) and use @conn in Liveview (mount(_, session, socket)) to put assigns to render the Logout link?

Imagine that we stand somewhere in Liveview and need the precisely way to perform logout action.

The logout action should still be a regular controller action since LiveView cannot set cookies/session.

I’m using the LiveView and also approach phx.gen.auth.
The web execute login as usual, but how can we logout by using UserAuth.logout_user from LiveView (no @conn)? As there is the logout templates that are rendered underneath LiveView’s template.

Here are the changes to enable this feature on top mix phx.gen.auth: Set the live_socket_id on login and disconnect on logout · dashbitco/mix_phx_gen_auth_demo@1eebcae · GitHub

It is really straight-forward and it is per session (i.e. it doesn’t disconnect all sessions, only the current one).

You can also disconnect just one of the sessions. All you have to do is identify the connections per session token rather than user id. That’s what I am submitting to mix phx.gen.auth.

Sorry I missed that the signature of mount/3 is mount(params, session, socket)… I am feeling a bit stupid now