Guardian Library issue - (Plug.Conn.AlreadySentError) the response was already sent

Hi Alia, if you do not show your code we can’t really help you.

@benwilson512 i am getting this issue when my cookie or my session get expire. whenever i am using halt() at the end of the response message this error got fixed but i don’t know why ?

Any guess about it ?

defmodule SportsConnect.Guardian.AuthPipeline do
  @claims %{"typ" => "access"}

  alias SportsConnect.Models.User

  use Guardian.Plug.Pipeline,
    otp_app: :sportsconnect,
    module: SportsConnect.Guardian,
    error_handler: SportsConnect.Guardian.AuthErrorHandler

  plug Guardian.Plug.VerifySession, claims: @claims
  plug :load_user

  # Load the current user if user is logged in the system.
  def load_user(%{cookies: %{"access" => access_token}} = conn, _) do
    user = SportsConnect.Guardian.resource_from_token(access_token)

    case user do
      {:ok, %User{id: user_id}, _claims} ->
        user = Sportsconnect.Repo.get(User, user_id)
        Plug.Conn.assign(conn, :current_user, user)

      _ ->
        body = Jason.encode!(%{error: "Please Login to Continue"})
        send_resp(conn, 401, body) |> halt
    end
  end

  def load_user(conn, _) do
    body = Jason.encode!(%{error: "Please Login to Continue"})
    send_resp(conn, 401, body) |> halt
  end
end

As you said yourself, you have to use Plug.Conn.halt/1 otherwise plug will continue to process the other plugs that come after.

send_response does not halt / end your plug pipeline

This is not the right way to use Guardian. You should use the EnsureAuthenticated plug to ensure they are signed in, and handle any errors in your AuthErrorHandler.

However, it looks like you are only storing the user id in the token, in which case you can probably remove Guardian completely and just store the user id directly in the session, avoiding all the complexity and indirection that comes with using Guardian.

@adamu actually i am putting my token received after from Guardian in my Cookie. If i will completely remove the Guardian then what will i store in my cookie ? make sense ?

conn = Plug.Conn.put_session(conn, :user_id, user.id)

okay and how i will save my session for some time ? as well as how i will verify it at the time of sign in ?

The session is stored, encrypted, in the browser. The code I wrote saves it, that’s all you have to do.

user_id = Plug.Conn.get_session(conn, :user_id)

The session cookie is encrypted by Phoenix and can be trusted, the end user is not able to set the user_id

yes @benwilson512 you are right. Yeah i should save the user-id into my session. But in every request i need to verify that some one is login or not means i need to check and verify the session ?

In guardian i am doing it in an AuthPipeline but in your idea where i will do these things ?

The Programming Phoenix book has a chapter where it walks you through setting up user authentication.

There’s also phx.gen.auth.