That’s what I’m saying, you have to assign all over again this time pulling your token out of the session. It’s a clean slate for state, ie, socket.assigns.
sodapopcan
0
Arsenalist
Yes, but there’s nothing in the session as the first on_mount set it as socket.assigns (not session). To my knowledge, you can’t really store something in session in a LiveView, which is now why I’m leaning towards storing the stuff I need to store in the DB using the session.id as the key. I just hope it’s not overkill for this siutation.
0
sodapopcan
That’s what I was saying in my first answer: in the first match, get it from params then you need to store it either in session or the db. Even if you store it in the db you still need it in the session. I would take a look at how phx_gen_auth does it for inspiration. It’s not for an API but the same concept around tokens. Basically in the second clause you want:
def on_mount(:default, _params, %{"api_token" => api_token}, socket) do
case validate_token(api_token) do
# ...
One thing that you are possibly getting confused by (which I was also confused by) is that the “session” in live_session is an overloaded term that does not refer to an HTTP session. It just maintains the same BEAM process is maintained over the same web socket connection between navigations, but that’s it. It has nothing to do with HTTP sessions, which is to say you will have to store the token in the HTTP session yourself.
0
Arsenalist
Thank you. Sorry for being dense on this, but how do I store it in session in my on_mount? I only know how to store it in socket and then return it using {:cont, socket}
0
sodapopcan
No prob, no matter how easy frameworks make stuff, web programming is the worst (even though I like it) 
It’s actually best to do it in a plug since you can’t write session data over web sockets (this is a limitation of web sockets, not LiveView). I would make a new project and run mix phx.gen.auth Accounts User users and look at the UserAuth module. The short answer is that you want, Plug.Conn.put_session though. Basically move that whole initial validation logic to a plug and then your on_mount can always read from the session.
Sorry I can’t point you to anything that implements actual API auth.
0
