pavelsof
LiveView.Socket authentication for a LiveDashboard in production
Imagine we have a Phoenix application with live views and we want to enable the live dashboard in production. We put the live dashboard behind some admins-only authentication, e.g. using Plug.BasicAuth as suggested in the docs.
What would prevent a hypothetical attacker from accessing our live dashboard metrics directly via the Phoenix.LiveView.Socket? As far as my (admittedly not very deep) understanding goes, the plug would protect accessing the live dashboard routes, but (1) the live view socket would happily accept any connection, and (2) the live dashboard does not do auth checks on mount as suggested in the live view docs. Please help me understand!
Most Liked
benwilson512
I could be wrong, but I believe websockets are established by doing a GET and including an upgrade header. This GET is subject to the standard routing and authentication rules, so connecting “directly” isn’t really a thing.
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Producing high quality Elixir screencasts since 2017.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"