4 ms·
Interesting. When I generate auth for Phoenix the API endpoints are not piped through any security pipes. Only the browser endpoints. Why wouldn't I secure my A
by zwnow 2y ago
Interesting. When I generate auth for Phoenix the API endpoints are not piped through any security pipes. Only the browser endpoints. Why wouldn't I secure my API endpoints? The same kind of requests that are made for browser requests are sent to the API routes, so this is really confusing.
- arrowsmith 2y agoAh yes. `phx.gen.auth` generates a cookie-based auth system, which is fine for the :browser pipeline but it's not generally what you want for a JSON API. The Phoenix docs include a suggestion for how you can extend `phx.gen.auth` to add token-based authentication to your API: https://hexdocs.pm/phoenix/api_authentication.html https://hexdocs.pm/phoenix/api_authentication.html (No, this isn't "rolling your own auth" either, it's using someone else's pre-written auth code.)