Exploring Cookies set by phoenix methods and sending ajax request with auth token in header

If you use the http_only flag the browser will not let any Javascript access the cookie, therefore you JS code will not be able to read the auth_token to use in an Ajax call.

Read more about securing cookies here:

Now, if you need to use this auth_token to call a thrid-party API, then the only secure approach is to delegate that task to your Phoenix backend that will then return the response to the browser via a socket event.

but how will i have socket between a normal js file that dont have access to anything other than DOM, Can you please elaborate, and FYI I am sending the ajax request to my same site, just I am calling the API endpoint (callable from Mobile app/ frontend framework) from Normal html templates in phoenix via javascript instead.

You can use Phoenix Channels:

Just send a request to the backend via a Phoenix Channel to get a new auth_token with some seconds worth of time to expire, and then do the Ajax request to the API endpoint.

Any data you need to get from the same API endpoints you may want to do it internally from your backend.

So, just request the data via a Phoenix Channel and then update your DOM when you get a response, as per examples in the above link to Phoenix Channels docs. Maybe instead you prefer to just use Phoenix LiveView if you decide to go down this route.

If you want to go old school by using a normal AJAX request, then your security will be weaker, because you cannot secure secrets in the client side. As you already know in the browser all it takes is to use F12 to get the auth_token or it can be stolen from another JS script, but even in your mobile app the auth_token to query the API can be extracted, despite the code being in binary format(the APK) on the client side.

Just to clarify. Sockets (Phoenix Channels) and a request (fetch/ajax) are two different things. Most likely what you need is a simple request.

Make sure you check out the official Phoenix tutorial on sessions: https://phoenixframework.readme.io/v0.13.0/docs/sessions

There they use put_session and get_session to save/read session variables.

Does that answer your question?

hi, is it the case that , plug.session key-value pairs are not visible to anyone right? so I wont be able to access the value using javascript, even if i store it, because I cannot access sesssion value from js, so any way around?

yes. session variables are server-only information.