coen.bakker
User passwords in logs of deployed LiveView app
I have a hobby project that I deploy on fly.io since recently.
When I check the logs (with flyctl logs) I can see passwords of users (only me actually currently) as part of socket messages.
For example:
Last message: %Phoenix.Socket.Message{topic: "lv:phx-F6LyLij5Vszh4gGx", event: "event", payload: %{"event" => "save", "type" => "form", "value" => "_csrf_token=OVJ*****UD&user%5Bemail%5D=testemail%40gmail.com&user%5Bpassword%5D=password1234"}, ref: "21", join_ref: "4"}
The purpose of this hobby project is to get familiar with deploying and potential pitfalls. How do I safely handle messaging the passwords? I am using phx_gen_auth in a recently generated LiveView app ([{:phoenix, "~> 1.7.7"}, {:phoenix_live_view, "~> 0.19.0"}])
Most Liked
kokolegorille
Last Post!
coen.bakker
Thanks 
.
Some other thoughts.
I know passwords get hashed on the server with phx_gen_auth. And it requires the original password to make the hash. And the password needs to be sent to the server somehow; in this case over the socket connection.
So it seems like the right configs are crucial for not exposing passwords to devs. Seems like an easily corruptible model. But maybe that’s just how it is?
I’m still in the process of checking out pow and alternatives, to eventually make a choice for an auth model. So maybe I’ll find some answers along the way…
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Move fast and fix things! Error tracking with less noise for Elixir devs who love to ship. Start your free dev account.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking for Elixir devs who love to ship. Start your free account.
Develop your skills with books, videos, and courses.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"