This may be the iOS disconnecting all web sockets when on background to save energy. The solution is to make sure the app can go back to that step even on reload. On a two step authentication, I usually store the success of every step in the session.

Not quite, there is put_session in the conn. If you are using LiveView, the trick is to use phx-trigger-action to submit a page where you then validate the credentials/form and persist to the session.

The LV will die on disconnect, you can probably pubsub to something to see the event or write a hande_info() callback and try to save some kind of recovery data to the server then but it is probably preferable to encode your recovery data into the browser and either use:

• phx-auto-recover and a form Form bindings — Phoenix LiveView v1.2.5 or
• browser session/cookie/localstorage: Saving and Restoring LiveView State · The Phoenix Files
• Or sometimes you can just encode the recovery data into the URL and handle_params() depending on what you are working with (you could encode some recovery token and load progress from the db for example).

In any case, careful that you sanitise the data coming back. Your form will be easily editable, the session can be made more tamper resistant. You also don’t have to encode “user_id=1” into the form, you could encode the data similarly to how Fly talks about using the session.