LiveView.Socket authentication for a LiveDashboard in production

Phoenix Forum Questions / Help
,
1

Imagine we have a Phoenix application with live views and we want to enable the live dashboard in production. We put the live dashboard behind some admins-only authentication, e.g. using Plug.BasicAuth as suggested in the docs.

What would prevent a hypothetical attacker from accessing our live dashboard metrics directly via the Phoenix.LiveView.Socket? As far as my (admittedly not very deep) understanding goes, the plug would protect accessing the live dashboard routes, but (1) the live view socket would happily accept any connection, and (2) the live dashboard does not do auth checks on mount as suggested in the live view docs. Please help me understand!

2

I could be wrong, but I believe websockets are established by doing a GET and including an upgrade header. This GET is subject to the standard routing and authentication rules, so connecting “directly” isn’t really a thing.

2 Likes
3

Thank you very much for the answer! So I should apply the auth plug to the live socket as well as to the live dashboard routes, do I understand this right?