CSWSH is real, and I believe it’s wise that Phoenix doesn’t make it too easy

In my specific case, the websocket URL is unique and unguessable (contains long, random token), and I need user ID from the session to verify if the resource is owned by the user. Given one needs to obtain the secret websocket URL first, which is only accessible to the authenticated user, I believe in my case there’s no practical risk.

I’ve settled on the following code to extract user ID from the session in cowboy_websocket handler:

@session_key Keyword.fetch!(Application.compile_env!(:asciinema, :session_opts), :key)
@signing_salt Keyword.fetch!(Application.compile_env!(:asciinema, :session_opts), :signing_salt)

defp user_id_from_session(req) do
  cookies = :cowboy_req.parse_cookies(req)

  with {_, cookie} <- List.keyfind(cookies, @session_key, 0) do
    secret_key_base = Application.fetch_env!(:asciinema, Endpoint)[:secret_key_base]
    conn = %{secret_key_base: secret_key_base}
    opts = Plug.Session.COOKIE.init(signing_salt: @signing_salt)
    {:term, session} = Plug.Session.COOKIE.get(conn, cookie, opts)

    session["user_id"]
  end
end