dcrck
Creating a public WebSocket endpoint with Phoenix Channels
I’m interested in creating a public API for my Phoenix channels, so that clients in external apps can subscribe to their events. Additionally, the channels should require authentication from clients for them to start receiving events.
This is definitely possible with Phoenix, and I understand that the socket is exposed at localhost:4000/socket/websocket, but most of the examples I can find on the internet are focused on joins/subscriptions within the same app, rather than from outside the app. In other words, they rely on a token that’s created when you log in, and encoded in the HTML somewhere.
Does anyone have any examples of protected Channel topics that support authentication from external apps? For example, you connect to the socket, pass your credentials in a message to authenticate, and then you can subscribe to a specific channel? I can’t seem to find any to study, even though I would think this isn’t a unique use case. Of course, this could be very straightforward or I could be ignoring something obvious, in which case feel free to correct me. Thanks in advance!
Marked As Solved
sb8244
Word—if you’re just setting up your other apps to subscribe to the sockets, then I would go for the much lighter weight solution. Something like rolling credentials doesn’t really matter when it’s all in your control, because you know what to expect and can mitigate or ignore as necessary.
The solution I laid out would be for the type of system like when you setup auth with Github (which has access tokens and OAuth apps separated from other access).
Also Liked
sb8244
The great thing about Channels is that you have complete control over the lifecycle. So you can use something like a Phoenix Token or a JWT out-of-the-box, or you could roll your own token exchange mechanism.
Do you currently have any mechanism for a person to register with your API? At work, we use OAuth to do so, which we then exchange for a JWT token on an edge server and pass around as JWT internally. You could do something similar where you take a token (any format, could even be an OAuth access token) and validate that against your database in the Phoenix.Socket connect/3 function.
There’s not much difference between a public and private API from an operational perspective. You need a different auth mechanism (usually), you need to make sure you don’t break the contract or existing users will be upset when their apps break, and you need to have good documentation. Other than that, I consider it business as usual.
dcrck
I see, so an OAuth 2 provider is what I’m looking for. This Elixir library should be a good starting point, then. 
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"