[Question / feature request] API only support & Phoenix channels

[mradke]

Currently, I am researching different strategies on how to do authentication properly in my Elixir applications. That is how I stumbled over pow, so please forgive my ignorance if I missed something, I just skimmed over the documentation, tutorial and the code.

I think you managed to come up with a remarkable API design for pow ❤️

Question

I have basically one question: is it currently possible (I have not found out, yet) to identify users when using channels?
For example with plain phoenix sessions, we cannot do this, because there are no cookies sent over the socket.

Proposal

I'd like to use pow for an API only project. Hence I don't want, nor need, the HTML templates and routes.

Would it be feasable, to add something like an ApiRouter as a an extension, or would it be better to have it as part of the core modules and simply mimic the functionality found in Pow.Phoenix.RegistrationController and Pow.Phoenix.SessionController?

Or am I missing something, and this is already easily possible? 😊

[danschultzer]

Thanks!

You may want to look at the Guardian example for token auth (this could easily be replaced with the Phoenix.Token):

https://github.com/danschultzer/pow#authorization-plug

And custom controllers for the API:

https://github.com/danschultzer/pow/blob/master/guides/CUSTOM_CONTROLLERS.md

There has been successful usage of Pow in GraphQL/absinthe apps. In this case you would just leverage the plug methods, and add a custom auth plug that adds a token to the conn that will be used in for the channel auth.

Please let me know if this works, I haven't build anything with channels personally yet 😄

[mradke]

I love how the guide yells CUSTOM_CONTROLLERS at me and I still missed it 😂
Will try your suggestions. When it is used in Absinthe, it should also work in channels since we would not have a conn map in the resolvers as well if I'm not mistaken.

I try to remember coming back to you on this. Thanks for the help 👍