security

Elixir/Phoenix Security Reference

Ash projects: AshAuthentication has its own strategy/token patterns — use the ash-framework skill. CSRF, XSS, and secret management patterns below still apply.

Quick reference for security patterns in Elixir/Phoenix.

Iron Laws — Never Violate These

1. VALIDATE AT BOUNDARIES — Never trust client input. All data through changesets
2. NEVER INTERPOLATE USER INPUT — Use Ecto's ^ operator, never string interpolation
3. NO String.to_atom WITH USER INPUT — Atom exhaustion DoS. Use to_existing_atom/1
4. AUTHORIZE EVERYWHERE — Check in contexts AND re-validate in LiveView events
5. ESCAPE BY DEFAULT — Never use raw/1 with untrusted content
6. SECRETS NEVER IN CODE — All secrets in runtime.exs from env vars
7. LIVEVIEW EVENT PARAMS ARE UNTRUSTED — Users can alter forms, hooks, and every phx-value-* in DevTools. Validate and authorize against server-side state before acting

Quick Patterns

Timing-Safe Authentication

def authenticate(email, password) do
  user = Repo.get_by(User, email: email)

  cond do
    user && Argon2.verify_pass(password, user.hashed_password) ->
      {:ok, user}
    user ->
      {:error, :invalid_credentials}
    true ->
      Argon2.no_user_verify()  # Timing attack prevention
      {:error, :invalid_credentials}
  end
end

LiveView Authorization (CRITICAL)

# `id` is client input even when it came from phx-value-id.
# RE-AUTHORIZE IN EVERY EVENT HANDLER
def handle_event("delete", %{"id" => id}, socket) do
  post = Blog.get_post!(id)

  # Don't trust that mount authorized this action!
  with :ok <- Bodyguard.permit(Blog, :delete_post, socket.assigns.current_user, post) do
    Blog.delete_post(post)
    {:noreply, stream_delete(socket, :posts, post)}
  else
    _ -> {:noreply, put_flash(socket, :error, "Unauthorized")}
  end
end

Rendered LiveView events can expose IDs in HTML and websocket payloads. That is not automatically a vulnerability: treat IDs as public identifiers, never as proof of access. Use opaque references only when the identifier itself must not be disclosed, and still perform server-side authorization.