victorbjorklund
I want to use Ash again (I tried it a year ago but I’m now returning to try out 3.0) but I’m a little bit unsure about Ash Authentication. I am far from a security expert so maybe my concerns are not valid but I was wondering about how to implement refresh tokens using Ash Auth. As far as I understand it is not very good practice to use long lived stateless jwt tokens since it is impossible (or very hard) to invalidate them if they need to be invalidated before expiry. So most people seems to recommend a short lived access token (seconds or minutes) and a refresh token that is stored in the database.
In the docs to ash auth it says: “Since refresh tokens are not yet included in ash_authentication, you should set the token lifetime to a reasonably long time to ensure a good user experience. Alternatively, refresh tokens can be implemented on your own.”
How would one add refresh tokens to an app using ash-authentication? I know how I could do it in a “vanilla” Phoenix app but not with Ash (my macro skills are very poor). Is it possible without forking ash-authentication and rewriting a large part of the library? If so any hints on how one would do it?
Where Next?
Trending in Questions
Other Trending Topics
Latest Ash Threads
Latest on Elixir Forum
Sponsor Spotlight
Elixir, Erlang & messaging conferences from Code Sync. Next up: ElixirConf US (10–11 Sep) & Code BEAM Europe (21–22 Oct), Haarlem + online.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 1- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
zachdaniel
Don’t have time right now for a more involved answer, but there are discussions of how it can be implemented elsewhere in the forum, have a search around and see if you can find them. I think one was pretty recently.
As for difficult to revoke, AshAuthentication has a good option which I typically prefer anyway as I like to have state representing all current valid sessions, which is that you can do:
In which case authentication tokens are stored and you can delete one or expire it in the database. Can be great for showing users things like “what active sessions do you have now” and that kind of thing.