31–37 of 37 posts
I cried in pain when I got to securing my app (uberauth, guardian etc). There's too much to grasp and I ended-up just copy pasting code in frustration. Elixir & phoenix are fun though. I really like how much easier it is to test an elixir app (functional language).
I cried in pain when I got to securing my app (uberauth, guardian etc). There's too much to grasp and I ended-up just copy pasting code in frustration. Elixir & phoenix are fun though. I really like how much easier it is to test an elixir app (functional language).
I cried in pain when I got to securing my app (uberauth, guardian etc). There's too much to grasp and I ended-up just copy pasting code in frustration. Elixir & phoenix are fun though. I really like how much easier it is to test an elixir app (functional language).
I cried in pain when I got to securing my app (uberauth, guardian etc). There's too much to grasp and I ended-up just copy pasting code in frustration. Elixir & phoenix are fun though. I really like how much easier it is to test an elixir app (functional language).
You can use Coherence. It's basically Devise for Elixir: https://github.com/smpallen99/coherence
For example, when I last read through the codebase it was common to find features that simply wouldn't work, because the code referenced hardcoded parts of the sample application.
You'll also going to run into a lot of issues trying to migrate off of Coherence if you ever need to support anything other than form based username / password login.
I think it really is worth the effort to go with Ueberauth [0]. You'll need to do more work upfront, but the maintainability gains will quickly pay off. You can even use :ueberauth_identy [1] to provide username / password based auth without too much trouble.
Has anyone used gen stage / flow for their jobs / small - medium projects ? What are some examples where this could be used ? Game server ? I found an example on YouTube about using it in an automation warehouse but that seems too niche to implement
It lets us super easily manage things like rate limiting and throttling, while providing backpressure so that an influx of scans (or scans on large APIs) won't overload our infrastructure.
Earlier quoted context omitted.
You can use Coherence. It's basically Devise for Elixir: https://github.com/smpallen99/coherence
I've been coding Elixir professionally for a few years, and working in security for longer, and I recommend against using Coherence for anything but toy apps. It's a fairly full-featured Devise-substitute, but the code quality isn't great, and a lot of the less-used features haven't had any sort of real-world testing. There's been a few trivial, high-severity security vulnerabilities in it, and I wouldn't be surprise…
I don't agree about ueberauth though. It assumes too much knowledge on the part of the developer, and is insufficient if one is looking for a "plug and play" authentication solution. I used it with Guardian but in the end moved away from it because using JWTs for authentication is just not a good idea.
Earlier quoted context omitted.
I've been coding Elixir professionally for a few years, and working in security for longer, and I recommend against using Coherence for anything but toy apps. It's a fairly full-featured Devise-substitute, but the code quality isn't great, and a lot of the less-used features haven't had any sort of real-world testing. There's been a few trivial, high-severity security vulnerabilities in it, and I wouldn't be surprise…
I agree about Coherence. It's good for starter apps, but becomes a liability for anything more serious. Like you say, too much stuff is hardcoded, and moving away from it is painful. I don't agree about ueberauth though. It assumes too much knowledge on the part of the developer, and is insufficient if one is looking for a "plug and play" authentication solution. I used it with Guardian but in the end moved away from…
Ueberauth definitely isn't a turnkey solution, but I'm not convinced that turnkey solutions for authentication are possible for real use cases. It's only going to be so long before you run into a customer that needs to integrate you into their SSO provider, and even Devise isn't going to help you then.
What Ueberauth needs, in my opinion, is a hex, built on ueberauth_identity, that adds support for everything people have grown accustomed to from Devise, like password resets, out of the box. You'll still need to do the manual work of mapping credentials to your user resource, but at least you'll be leaving yourself open to eventually supporting other authentication methods, without too much carrying cost in the meantime.
Elixir will get there eventually though :)