How to secure a Phoenix app?

See Securing Rails Application. I know it’s neither Elixir nor Phoenix, but the basic ideas about security are the same. You just need to implement these ideas with Elixir/Plug/Phoenix if they are not implemented by default.

Make sure you don’t log sensitive things like passwords or PII. I added opt in logging for query parameters to Phoenix a while ago, where you have to be explicit about which things you allow to be logged.

config :phoenix, :filter_parameters, {:keep, ["id", "order"]}

Also don’t forget…

@aethereus rails guide is good thanks
@blatyo I never thought about logs, really important thing.
@AstonJ @griffinbyatt having a elixir library is really nice.

“Secure” distribution

If your app is distributed over multiple machines, make sure the nodes communicate over a secure channel like vpn (almost every cloud provider supports some sort of private networking) or tls [1, 2] (if you use several cloud providers for your app and it needs to keep a shared state).

[1] Erlang Distribution over TLS — OTP 29.0.2 (ssl 11.7.2)
[2] Erlang Consultancy and Development - Erlang Solutions

DDoS attack mitigation

or at least an attempt at

Check out [3] and [4]. Or, if you use haproxy (usually a good idea), maybe look into [5]. You can also use haproxy to terminate tls connections, since it would probably do a better job at it than erlang.

Note #1: if you do end up using haproxy for tls termination and/or load balancing, the general advice seems to be to pick a machine with a small number of high frequency cores [6].

Note #2: erlang, and by extension cowboy, are not particularly well suited for serving static assets, especially over tls on linux (freebsd seems to have some support for sendfile over tls [7]), so maybe pick nginx or h2o [8] for it.

[3] GitHub - michalmuskala/plug_attack: A plug building toolkit for blocking and throttling abusive requests · GitHub
[4] Ask HN: How is DDoS protection implemented? | Hacker News
[5] Application-Layer DDoS Attack Protection With HAProxy
[6] HAProxy version 1.8.30 - Starter Guide
[7] https://people.freebsd.org/~rrs/asiabsd_2015_tls.pdf
[8] https://h2o.examp1e.net/

“Secure” configs

Some cloud providers have tools like azure key vault [9]. But you can also host hashisorp vault [10] yourself. These are good for storing sensitive configuration information like database credentials and the like.

[9] https://azure.microsoft.com/en-us/services/key-vault/
[10] https://www.vaultproject.io/

A good resource is OWASP. Here’s a checklist of good coding practices:

In addition to the application, there is a lot that you can do to add security when deploying it: Improving app security with the principle of least privilege

Phoenix’s ability to proxy connections efficiently allows some very interesting architectures for better security: Secure web applications with GraphQL and Elixir

Happily working my way through this thread and all the suggestions and resources posted in it.

It has been a few years since the last posts. Any new suggestions and resources for those of us (including me) that are trying to learn the ins and outs of applied web/Phoenix security in 2022?

We are migrating our SaaS application to LiveView and this documentation helped a lot.

https://hexdocs.pm/phoenix_live_view/security-model.html

In our case we use Guardian + Ueberauth.

Don’t forget to secure on a server level too, disable root login or use passwordless authentication, change SSH ports, block unused ports in your firewall, consider installing software like fail2ban/Denyhosts etc.

Usually your host will have tips/guides on how to do it for your OS, or they may even do a lot of it for you.