You should probably use mix phx.gen.auth even on a side project just to follow the code if you want to implement it from scratch. They’re using Phoenix.Token and save it in the session.

There should be nothing you have to do for session re-connects.

Also: you can use Phoenix.Token or JWT but you do not have to.

What phx.gen.auth is doing is actually different - they do not use either. They just generate a simple random token value using :crypto.strong_rand_bytes and then insert that token along with user_id to a database table.

After that’s done, the value of the token is set in the session.

Session is signed, so in theory they could have put user_id there, but their approach is smarter as they store the token in the session, but the mapping to user_id on server, which allows them to invalidate the session wherever they want by just deleting the token on the server.

This is the approach I have adopted across my apps, not just LiveView, and this has saved me a lot of trouble.

Phoenix.Token or JWT could be used instead of Phoenix sessions. You usually use them with APIs. They’re not suitable for session/cookie based authentication because of their size, which can be big and your session storage is probably in cookie, meaning that it has a hard limit that is not too big at all.

So that’s my gotcha at the end. I do advise you use mix phx.gen.auth and spend an hour or so with generated code, it will be very educational!