[] (http://www.projecttalk.io/boards/manukall%2Fphoenix_token_auth?utm_campaign=gh-badge&utm_medium=badge&utm_source=github)

I'm not actively using this project at the moment. I also implmemented most of it when I just started with Elixir, so the code is not exactly great. If you want to use it, be prepared to fork the project and invest some work.

Adds token authentication to Phoenix apps using Ecto.

An example app is available at https://github.com/manukall/phoenix_token_auth_react.

You need to have a user model with at least the following schema and callback:

defmoduleMyApp.UserdouseEcto.Modelschema"users"dofield:email,:string# or :usernamefield:hashed_password,:stringfield:hashed_confirmation_token,:stringfield:confirmed_at,Ecto.DateTimefield:hashed_password_reset_token,:stringfield:unconfirmed_email,:stringfield:authentication_tokens,{:array,:string},default: []end@required_fields~w(email)@optional_fields~w()defchangeset(model,params\\:empty)domodel|>cast(params,@required_fields,@optional_fields)endend

Make sure that you have uniqueness constraints on the email or username columns.

Then add PhoenixTokenAuth to your Phoenix router:

defmoduleMyApp.RouterdousePhoenix.RouterrequirePhoenixTokenAuthpipeline:authenticateddoplugPhoenixTokenAuth.Plugendscope"/api"dopipe_through:apiPhoenixTokenAuth.mountendscope"/api"dopipe_through:authenticatedpipe_through:apiresources"/messages",MessagesControllerendend

This generates routes for sign-up and login and protects the messages resources from unauthenticated access.

The generated routes are:

If you want to customize the routes, instead of

 scope "/api" do pipe_through :api PhoenixTokenAuth.mount end 

add

 scope "/api" do pipe_through :api post "users", PhoenixTokenAuth.Controllers.Users, :create post "users/:id/confirm", PhoenixTokenAuth.Controllers.Users, :confirm post "sessions", PhoenixTokenAuth.Controllers.Sessions, :create delete "sessions", PhoenixTokenAuth.Controllers.Sessions, :delete post "password_resets", PhoenixTokenAuth.Controllers.PasswordResets, :create post "password_resets/reset", PhoenixTokenAuth.Controllers.PasswordResets, :reset get "account", PhoenixTokenAuth.Controllers.Account, :show put "account", PhoenixTokenAuth.Controllers.Account, :update end 

And customize, change names/pipeline of the routes.

Inside the controller, the authenticated user is accessible inside the connections assigns:

defindex(conn,_params)douser_id=conn.assigns.authenticated_user.id...end

Now add configuration:

# config/config.exsconfig:phoenix_token_auth,user_model: Myapp.User,# ecto model used for authenticationrepo: Myapp.Repo,# ecto repocrypto_provider: Comeonin.Bcrypt,# crypto provider for hashing passwords/tokens. see http://hexdocs.pm/comeonin/token_validity_in_minutes: 7*24*60,# minutes from login until a token expiresemail_sender: "[email protected]",# sender address of emails sent by the appemailing_module: MyApp.EmailConstructor,# module implementing the `PhoenixTokenAuth.MailingBehaviour` for generating emailsmailgun_domain: "example.com",# domain of your mailgun accountmailgun_key: "secret",# secret key of your mailgun accountuser_model_validator: {MyApp.Model,:user_validator}# function receiving and returning the changeset for a user on registration and when updating the account. This is the place to run custom validations.

The secret key for signing tokens must be provided for Joken to work. You must also configure the JSON encoder for Joken to use. For using the Poison Encode function, we provide the PhoenixTokenAuth.PoisonHelper. The secret_key should be set per environment and should not be committed to the repository.

# config/config.exsconfig:joken,json_module: PhoenixTokenAuth.PoisonHelper,algorithm: :HS256# Optional. defaults to :HS256

# config/[dev|test|prod].exsconfig:joken,# Environment specific secret key for signing tokens.# This should be a very long random string.secret_key: "very secret test key",

• POST request to /api/users.
• Body should be JSON encoded {user:{email: "[email protected]", password: "secret"}}.
• This will send an email containing the confirmation token.

• POST request to /api/users.
• Body should be JSON encoded {user:{username: "usernameexample", password: "secret"}}.
• The user will be registered and, comparing to the email implementation, already confirmed.

• POST request to /api/users/:id/confirm
• Body should be JSON encoded {confirmation_token: "token form the email"}
• This will mark the user as confirmed and return an authentication token as JSON: {token: "the_token"}.

• POST request to /api/sessions
• Body should be JSON encoded {email: "[email protected]", password: "secret"}
• Will return an authentication token as JSON: {token: "the_token"}

• POST request to /api/sessions
• Body should be JSON encoded {username: "usernameexample", password: "secret"}
• Will return an authentication token as JSON: {access_token: "the_token", token_type: "bearer", id: "recordid"}

• Add a header with key Authorization and value Bearer #{token} to the request.
• #{token} is the token from either account confirmation or logging in.

• DELETE request to /api/sessions
• Just stop sending the Authorization header.

• POST request to /api/password_resets
• Body should be JSON encoded {email: "[email protected]"}
• This will send an email as configured.
• Once the reset token is received in the email, make a POST request to /api/password_resets/reset with body {user_id: 123, password_reset_token: "the_token_from_the_email", password: "the_new_password"}
• This will change the users password and return an authentication token as JSON: {token: "the_token"}.

• PUT request to /api/account
• Body should be JSON encoded {account:{password: "newpassword"}}

• PUT request to /api/account
• Body should be JSON encoded {account:{email: "[email protected]"}}
• This will send an email containing the confirmation token.
• The change will only be effective after the email address was confirmed.

• Better documentation
• Clean up expired authentication tokens in the db
• Merge the Joken secret_key config into the phoenix_token_auth config.
• Custom work factor config for crypto_provider
• Allow use of scrypt as an alternate crypto_provider
• Example Ecto Phoenix migration, with indexes.