phoenix-authorization-patterns

Phoenix Authorization Patterns

RULES — Follow these with no exceptions

1. Always authorize on the server in event handlers — UI-only checks (hiding buttons) are not security; always verify in handle_event/3
2. Verify resource ownership by comparing current_scope.user.id against the resource's user_id — never trust client-sent user IDs
3. Use policy modules for complex authorization — don't inline permission checks in LiveViews or controllers
4. Add data-confirm attribute for destructive UI actions — client-side confirmation before server round-trip
5. Test both authorized and unauthorized paths — every handle_event that mutates data needs an authz test proving unauthorized access is rejected
6. Scope queries to the current user in contexts — where(user_id: ^user_id) prevents IDOR vulnerabilities

---

Server-Side Authorization in LiveViews

UI checks prevent accidental clicks. Server checks prevent attacks. You need both.

defmodule MyAppWeb.PostLive.Show do
  use MyAppWeb, :live_view

  @impl true
  def mount(%{"id" => id}, _session, socket) do
    post = Blog.get_post!(id)
    {:ok, assign(socket, :post, post)}
  end

  @impl true
  def render(assigns) do
    ~H"""
    <h1><%= @post.title %></h1>

    <%!-- UI check — hide button if not owner --%>
    <%= if @current_scope.user.id == @post.user_id do %>
      <.button phx-click="delete" data-confirm="Are you sure?">
        Delete
      </.button>
    <% end %>
    """
  end

  # Server check — ALWAYS verify ownership
  @impl true
  def handle_event("delete", _params, socket) do
    post = socket.assigns.post

    if socket.assigns.current_scope.user.id == post.user_id do
      {:ok, _} = Blog.delete_post(post)
      {:noreply, push_navigate(socket, to: ~p"/posts")}
    else
      {:noreply, put_flash(socket, :error, "Not authorized")}
    end
  end
end

---

Owner-Only Pattern

The simplest and most common authorization pattern. Extract it for reuse.