Redis backend, questions

[hyperknot]

Sorry if this is a silly question but I couldn't find any other way to ask it, and there was no information in the wiki.

Do I understand it right that:

• phauxth is using server stored sessions vs. the client stored JWT method used by guardian?
• If using server stored sessions, where does it store them? In the normal PostgreSQL database, running one SQL query per each request?
• If so, would it be possible to use Redis in the future for session storage?
• When using with a REST API, I see that session create is returning a JSON which the client can store. How does reading of the session work in case of API clients?

[riverrun]

I'll try answering your questions by explaining how Phauxth.Authenticate works. I think that will make things a little bit clearer.

Phauxth.Authenticate has two possible authentication methods, but both of these can be customized. By default, it uses Plug cookie-based sessions. You can also use tokens (similar to Phoenix.Token), and you would probably want to use tokens with a REST API.

The Plug sessions use signed (not encrypted) cookies to store a reference to the user (there is nothing stored on the server), and if the cookie is valid, Phauxth.Authenticate then makes a database call to collect information about the user. This can be overridden by creating your own Authenticate module with a custom check_session function.

In the case of tokens, Phauxth.Authenticate needs to be called with the option method: :token, and the token needs to be in the request headers. If the token is valid, Phauxth.Authenticate makes a database call to collect information about the user. This can be overridden by creating your own Authenticate module with a custom check_token function. If, for example, you wanted to use JWTs, you could have a custom check_token which validates the JWT, instead of the regular token.

Note that one of the goals of Phauxth is that it is highly extensible (instead of providing many options, I prefer to give the developer the opportunity to define their own options), so these methods can be overridden. In theory, there should be no problem with using Redis, or any other method, for session storage.

Here an example of a simple API using Phauxth.

If you have any further questions, just let me know.

[guidotripaldi]

This explanation is very clear, could be used in an introductory section of the documentation. If you like I can open a new wiki page and work on it.

[riverrun]

I added some of this information to the home page of the wiki. Feel free to look at that and make changes if you think we can make it clearer.

[riverrun]

Closing this issue. If you have any further questions, feel free to open an issue or post a question at the gitter page.