elt547
Does authorizing the mount protect the event handlers?
If I authorize users inside the mount function of a liveview, does that protect the event handlers as well? For example if I redirect inside of a mount function, will that disallow access to the event handlers over the socket connection?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Catch errors, track performance, monitor hosts and more.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #performance
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Develop your skills with books, videos, and courses.
Producing high quality Elixir screencasts since 2017.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First Post!
jerdew
If I understand right, you want to read: Security considerations — Phoenix LiveView v1.2.5 in full.
Permissions might change while someone is logged in, so on mount may not be enough. There are 3 places you might secure: mount/on_mount, each handle_event, and when permissions change you can disconnect all the affected user forcing them to log in again. The above docs will hopefully help you decide based on your circumstances.
Last Post!
felix-starman
I usually end up rolling my own until I know what kind of access control I need long term, and how quickly it will evolve into Attribute Based Access Control. If I’m lucky it’ll only ever be a minimal role based with hardcoded roles that aren’t going to change, but I’m not usually lucky. I usually end up reimplementing something in-between policy_wonk and bodyguard and making a custom queryable or two per context that may define scopes when I need it to be a part of a complex query too
I’ve only ever needed to migrate to one of them once and it was fine. But I’ve usually been in the healthcare space where authorization is usually a lot more complicated than typical use case these libraries are designed to solve for. It’s not that they can’t do them or anything, just that it’s easy to abuse them early on, instead of rethinking your boundaries when things get messy.
My only experience with canary was working with a bunch of recent ruby devs who loved action hooks and wanted something familiar, but my feeling is that it hides the need for more contexts by normalizing reimplementing the authz logic in a new controller.