madshargreave
Hi
I am currently using Guardian to authenticate my client-side react app with JWTs
I have two problems.
- I’d like use multiple subdomains. Saving the JWT in localstorage does not work for this as it is not cross-domain. Instead I am contemplating saving the JWT inside a cookie instead.
- I’d like to use the same controller actions as in 1. for my public-facing API, but instead use a access token approach in this case.
So what is a good way to have different auth schemes, while reusing controllers?
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Catch errors, track performance, monitor hosts and more.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #code-sync
- #discussion
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #ai
- #umbrella
- #elixirconf-us
- #full-time-contract
- #podcasts-by-brainlid
- #blog-post
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #elixirconf-eu
- #processes
- #security
- #api
- #forms
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync. Next: ElixirConf EU 2027
Bringing learning, work and compliance together since 1987.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
gdub01
Is it kind of like www.yoursalespage.com is where you sign them up. Then once they sign up, you log them in at www.yoursalespage.com and then redirect them to user1.yoursalespage.com? So that’s where you hit that localstorage jwt problem?
Would it be easier to have them sign up at www.yoursalespage.com… then you create user1.yoursalespage.com and forward them there where they’re hit with a login screen.
Then when they login via user1.yoursalespage.com you can store the JWT in localstorage there? Instead of www.yoursalespage.com.
You could keep a cookie www.yoursalespage.com so you know what subdomains that user has… but force them to login at their subdomain so you can keep the jwt in local storage.
bobbypriambodo
I don’t think there’s anything wrong with storing JWT in a cookie. Cookies and localstorage suffers from the same XSS vulnerabilities, and as long as you’re not sending the token by default with every request you should be safe from CSRF. The only difference would then be the size of the storage (localstorage can store bigger-sized content). With cookie you also gain the cross-domain capability.
For number 2, I think it’s only a case of defining a pipeline and scope. I never tried it, but I assume Phoenix router would allow different routes to have the same handler function?
madshargreave
You’re right, Phoenix router with pipelines and scopes worked perfectly.
Only problem I am having now is that Guardian does not seem to allow authenticating sockets using the cookie, as you must explicitly pass in the JWT on connection