Cookieless / Sessionless Phoenix and LiveView

egze

I was moving my personal site to Phoenix LiveView and noticed the there is always a session cookie present.

I’m wondering if it’s possible to run a LiveView application without cookies. There is this EU cookie law that there needs to be a warning if the site is using cookies and I would like to just have no cookies at all, to skip this cookie popup.

So the questions is:

How to run a Phoenix site without sessions/cookies?
How to run a LiveView enabled Phoenix site without sessions/cookies?

10 comments

/phoenix #session #liveview #cookies

2 3254 10

2020-04-26 10:06:51 UTC

Showing Posts 1 to 10

Show Best Posts
Show All Posts (oldest first)
Show All Posts (newest first)

lucaong

Not a lawyer, but the EU cookie law does not disallow all cookies. It explicitly allows those “strictly necessary for the delivery of a service requested by the user”, with one such example being a cookie used to implement a shopping cart in an e-commerce application. As long as you don’t use the session cookie for other tracking purposes not necessary for the functioning of your app, you should be fine.

The session cookie is in most cases “strictly necessary”, as your app cannot really work without, if it has to maintain any state. Conversely, third party cookies and tracking pixels are not strictly necessary, and would definitely fall into the ones you should be able to opt-out from. In between, there is a large gray area.

Here’s Wikipedia on that: ePrivacy Directive - Wikipedia

Post #1

egze

That’s the thing - I don’t want to get some letter from a lawyer and then explain to him the situation. If it is possible I just want to disable the source of the problem - cookies. Then I just don’t care.

Please let’s not debate the law and how to interpret it.

Post #2

LostKobrakai

The phoenix part is quite simple: remove the :fetch_session plug and all plugs depending on it. Also do not manually set cookies / use the session.

Same should be possible for live_view I guess, but again you cannot use any stuff depending on it, which by now should only be flash messages.

Post #3

egze

If I do that, the LiveView keeps crashing:

[debug] LiveView session was misconfigured or the user token is outdated.

1) Ensure your session configuration in your endpoint is in a module attribute:

    @session_options [
      ...
    ]

2) Change the `plug Plug.Session` to use said attribute:

    plug Plug.Session, @session_options

3) Also pass the `@session_options` to your LiveView socket:

    socket "/live", Phoenix.LiveView.Socket,
      websocket: [connect_info: [session: @session_options]]

4) Define the CSRF meta tag inside the `<head>` tag in your layout:

    <%= csrf_meta_tag() %>

5) Pass it forward in your app.js:

    let csrfToken = document.querySelector("meta[name='csrf-token']").getAttribute("content");
    let liveSocket = new LiveSocket("/live", Socket, {params: {_csrf_token: csrfToken}});

I’m having doubts that it can be used without session.

Post #4

LostKobrakai

This should only pop-up if you supply a :session key for the connect_info options:

github.com/phoenixframework/phoenix_live_view

lib/phoenix_live_view/socket.ex

v0.12.1


      
          case connect_info do
            %{session: session} when is_map(session) ->
              {:ok, put_in(socket.private[:session], session)}
          
            %{session: _} ->
              Logger.debug("""
              LiveView session was misconfigured or the user token is outdated.
          
              1) Ensure your session configuration in your endpoint is in a module attribute:
          
                  @session_options [
                    ...
                  ]
          
              2) Change the `plug Plug.Session` to use said attribute:
          
                  plug Plug.Session, @session_options
          
              3) Also pass the `@session_options` to your LiveView socket:

This file has been truncated. show original

Post #5

egze

Yepp. If I change

socket "/live", Phoenix.LiveView.Socket, websocket: [connect_info: [session: @session_options]]

socket "/live", Phoenix.LiveView.Socket

Then it works and no cookies are created. Sweet.

Post #6

egze

Actually, the issue is not solved yet In dev I see no cookies. but…

There are 2 problems:

In production there is still a cookie being created. Could not figure out yet, what is causing it.
Tests for live views don’t work anymore. I think they are always trying to load something from the session. It is strange, because in development the live_view works perfectly fine and no cookies are created.

1) test shows privacy policy (AppWeb.PageLiveTest)
     test/byteflip_web/live/page_live_test.exs:23
     ** (ArgumentError) session not fetched, call fetch_session/2
     code: {:ok, live_view, _disconnected_html} = live(conn, "/")
     stacktrace:
       (plug 1.10.0) lib/plug/conn.ex:1557: Plug.Conn.get_session/1
       (phoenix_live_view 0.12.1) lib/phoenix_live_view/test/live_view_test.ex:343: Phoenix.LiveViewTest.do_connect/7
       test/app_web/live/page_live_test.exs:24: (test)

What is more strange. In production if I disable cookies in my browser - the page keeps reloading.

Post #7