Stickersss
Long story short, I have a JavaScript frontend client and two backends: one in Python (for login/signup) and one in Phoenix (used only for websockets).
My Python backend sets an HTTP-only JWT token and successfully handles login and signup when users interact with the JavaScript frontend client.
Once a user has logged in, they should be able to connect to the Phoenix backend’s channels with the cookies previously set. I’ve managed to make Phoenix + Guardian work for JWT HTTP secure authentication, but I’m facing difficulties with websockets. As far as I know, sending an HTTP-only cookie to the Phoenix backend for websockets is not possible due to security reasons (browsers allow cross-origin connections that bypass CORS).
So, how can I authenticate my users from the frontend who have already logged in (with jwt token cookie http only set to true) and need to connect to Phoenix websocket channels?
Here are the solutions I’ve been considering:
- On the Python backend, when a user logs in or signs up, I set another cookie with an encrypted JWT and make it HTTP-only false. Then, I can access this token on the frontend’s socket connection to the Phoenix backend and verify & decode it.
- Create a REST API in the Python backend for the encrypted JWT, which I can use for websocket connections to the Phoenix backend for verification.
P.S: Still, I’m hesitant about encrypting the JWT and storing it in cookies with HTTP-only set to false. This approach leaves room for XSS vulnerabilities since the token can be accessed directly from document.cookies and potentially stolen for connecting to the Phoenix websocket backend as a victim
Where Next?
Trending in Questions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
codeanpeace
Welcome!
At this step/plug, couldn’t you set an additional Phoenix user token that plays nicely with websockets/Channels? It sounds like you’ve figured out JWT HTTP authentication with Phoenix so why not make an async HTTP call to your Phoenix backend that sets a Phoenix auth token which can then be used when connecting via websockets.
reference: Using Token Authentication | Phoenix Channels
Stickersss
Thanks a lot! I used exactly that approach and it seems to work well!
P.S: I had to document the authentication part for a documentation. If anyone in the future ends up in this thread, I’ve created an image showing different approaches