pavelsof
Imagine we have a Phoenix application with live views and we want to enable the live dashboard in production. We put the live dashboard behind some admins-only authentication, e.g. using Plug.BasicAuth as suggested in the docs.
What would prevent a hypothetical attacker from accessing our live dashboard metrics directly via the Phoenix.LiveView.Socket? As far as my (admittedly not very deep) understanding goes, the plug would protect accessing the live dashboard routes, but (1) the live view socket would happily accept any connection, and (2) the live dashboard does not do auth checks on mount as suggested in the live view docs. Please help me understand!
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
At WyeWorks, we believe great software is built by combining technical excellence with genuine human connection
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Practical resources that improve the lives of professional developers.
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
benwilson512
I could be wrong, but I believe websockets are established by doing a GET and including an upgrade header. This GET is subject to the standard routing and authentication rules, so connecting “directly” isn’t really a thing.
pavelsof
Thank you very much for the answer! So I should apply the auth plug to the live socket as well as to the live dashboard routes, do I understand this right?