What kind of authentication do you want? For cookie-based one you can use Plug.Conn.put_session/3 and Plug.Conn.get_session/2 (after the session has been fetched, which is done by the :fetch_session plug in the default phoenix :browser pipeline in the router). For header-based authentication I usually use bearer tokens which are stored in the database alongside other user / account data.

Guardian is a popular choice. GitHub - ueberauth/guardian: Elixir Authentication · GitHub

It is also quite simple to roll your own with Phoenix Token. This will be enough for any Web/API/GraphQL authentication. It is also possible to add autorization, as You can save role_ids inside tokens.

One fact with authentication, it highly depends on situation.

There are solutions for some cases…

• phxauth
• cohesion
• canada

Or ueberauth, if You want to integrate third party auth, like FB, Google, Github…

Which pre-rolled solutions do You have in mind?

I tried Guardian before and I couldn’t get it working. I’ll see if our Junior can do it.

Good set of tutorials here: https://medium.com/@Stephanbv/elixir-phoenix-lets-code-authentication-todo-application-part-1-599ee94cd04d

In my opinion JWTs in general and Guardian is appropriate for an API endpoint. Its not really geared towards web applications, for reasons that are well articulated in this somewhat salty article.

Cookie-based sessions work great. If you want a helper library, I can recommend doorman without reservation. We’ve been using it in production since January and have no complaints. We also use Guardian for our API endpoints (used by third-party applications - our SPA JSON endpoints still just use cookies).

https://github.com/jpiepkow/accesspass

I am bias because I made it but AccessPass is a pretty full featured auyh solution if you are looking for something to just work out the box with little code.

https://medium.com/@andreichernykh/phoenix-simple-authentication-authorization-in-step-by-step-tutorial-form-dc93ea350153

Guardian is a token/jwt library, it doesn’t do auth.

Guardian is a token/jwt library, it doesn’t do auth.

Guardian
An authentication library for use with Elixir applications. Guardian is a token based authentication library for use with Elixir applications.