So, how can we intercept a socket connection in Elixir to perform security checks, before it reaches the Phoenix Channels layers?
Exadra37
Exadra37
If I understand you this means an HTPP redirect, therefore defeating the security that the Third Party integration is meant to bring to the API.
0
LostKobrakai
Intercepting is the wrong approach imo. Transports are the implementation mapping from whatever network communication you use to the higher level channel. Instead of trying to intercept the implementation phoenix ships you can write your own implementation, which does deal with the connection of your third party API exactly as it’s needed. No need to intercept anything.
1
Exadra37
So, your suggestion is that I should implement the Phoenix.Socket.Transport behavior and then I may want to use the connect/1 to check the token?
0
LostKobrakai
Exadra37
This approach doesn’t work. I have no access to the Plug.Conn, therefore no access to the headers, thus cannot check the token.
Any other suggestions?
0
Exadra37
This is a bad practice in terms of security, therefore this will be the very last approach I will try.
0
Exadra37
Tried it, but doesn’t work. The x-header is correctly set in the conn but I cannot see it in the websocket connect/3.
plug :x_approov_token_header
def x_approov_token_header(conn, _opts) do
[{_header, value} | _ ] = for {header, _} = pair <- conn.req_headers, header in ["approov-token"], do: pair
Plug.Conn.put_req_header(conn, "x-approov-token", value)
end
socket "/socket", EchoWeb.UserSocket,
# socket "/socket", ApproovSocketTransport,
websocket: [
compress: true,
connect_info: [
:peer_data,
:trace_context_headers,
:x_headers,
:uri,
],
check_origin: {EchoWeb.AuthController, :check_socket_origin?, []}
],
longpoll: false
0
LostKobrakai
Seems like I have misunderstood how the system works to a degree. I was looking at this one, which indeed has the conn available:
https://github.com/phoenixframework/phoenix/blob/master/lib/phoenix/transports/websocket.ex
1
Exadra37
I also saw that one while diving into the Phoenix Framework core, but it seems to me that is what calls the Socket implemented done by the developer, but I may be wrong…
0