sc4224
Hi, asking for the opinion of elixir devs with experience in HIPAA compliancy.
As far as authentication goes. Is there a preference of token-based vs session-based authentication to ensure HIPAA compliancy? Would devs implementing authentication be predisposed to use one method over the other? Does HIPAA compliancy even prioritize one method over the other?
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Master modern tools, write cleaner code, and tackle real-world challenges with Manning books, videos, and courses. Start building today.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #phoenix_html
- #elixirconf-us
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 7- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
tangui
Hi,
No HIPAA experience but as stated here you have to support logout.
To manage logout with JWTs, you’ll need… to manage states! Also some links on JWTs for authentication sessions that have already been posted here:
sc4224
@tangui so does that it is HIGHLY recommended and BEST practice to use session-based authentication? Even though HIPAA does not specifically state anything about using session-based over token-based authentication, it is better to use session-based authentication anyway correct?
tangui
I have no idea about HIPAA but if it is required to manage logout (and you should read their specs / recommendations / etc.) then you better use stateful (= session-based) sessions because if you use stateless sessions (JWTs…), you’ll end up reimplementing stateful sessions to support logout.
My opinion is that JWTs became popular for this because it’s hard to manage state in a cluster behind load-balancing with most languages and platforms, but that’s not (or less) the case with Erlang / Elixir.
sc4224
@tangui ok i understand. As far as implementation of session-based authentication is concerned. I’m trying to use ueberauth/guardian to do the implementation. It seems like it is JWT (token-based) rather than session-based. Are there any alternative libraries or tutorials on how to implement session-based authentication for elixir? Does guardian provide an option for session-based authentication?
danschultzer
Pow uses sessions by default: GitHub - pow-auth/pow: Robust, modular, and extendable user authentication system · GitHub
PowAssent provides multi-provider support (ueberauth alternative): GitHub - pow-auth/pow_assent: Multi-provider authentication for your Pow enabled app · GitHub
tangui
You don’t necessarily need a library for that: just set an authentication cookie after authentication. Depending on the session lifetime and deployment scenario (cluster? single server? sticky sessions on your lb or not?) you have plenty of choices for a backend where to store sessions:
Also you have to secure your cookie by:
I saw that Dan posted an answer, so yes you might be interested too in lib that does that already
OvermindDL1
I deal with HIPAA at work, and I use session based to our SSO and it is time based logout, and if an early logout is performed it logs out of everything else that uses the SSO as well (and vice-versa). I just verify with the SSO on-access if the account is still logged in or not.
So… I put the onus on the people that manage the SSO (other contractors). ^.^