Did you have any luck with this? It seems inefficient that unauthenticated users (or users that have had their session time-out) keep trying to reconnect.
I agree that there should be a way to prevent the socket from being opened in a way that lets the client know it does not need to keep trying.
to reproduce the problem in a development environment
diff --git a/config/dev.exs b/config/dev.exs
index 7feeef0..17e8dfd 100644
--- a/config/dev.exs
+++ b/config/dev.exs
@@ -12,0 +13,4 @@ config :myapp, Myapp.Repo,
+secret_key_base =
+ System.get_env("SECRET_KEY_BASE") ||
+ :crypto.strong_rand_bytes(64) |> Base.encode64() |> binary_part(0, 64)
+
@@ -22 +26 @@ config :myapp, MyappWeb.Endpoint,
- code_reloader: true,
+ code_reloader: false,
@@ -23,0 +28 @@ config :myapp, MyappWeb.Endpoint,
+ secret_key_base: secret_key_base,
Just my 2c, but not everyone shares this sentiment. JWT are often used for much longer durations.
A quite common OAuth API convention uses a 60 min JWT expiration for authorization, with a much longer lived refresh token (which is also a JWT).