Soundcheck.Check.Warning.LiveRouteWithoutAuthHook (soundcheck v0.1.0)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

Flags live routes that run no authentication on_mount hook. Plugs in the router pipeline guard only the first HTTP request; a client navigating over an open socket reaches the LiveView without them, so each live_session needs its own on_mount check.

Before:

live_session :admin do
  live "/admin", AdminLive
end

After:

live_session :admin, on_mount: [{MyAppWeb.UserAuth, :require_authenticated}] do
  live "/admin", AdminLive
end

A hook counts when its module matches auth_hooks (atoms or regexes), whether it comes from the route's live_session or the LiveView's own on_mount, and when its compiled on_mount/4 clause for the hook's argument can stop the mount: return {:halt, socket} or raise. A hook that provably always continues, such as phx.gen.auth's :mount_current_scope, only loads the user and protects nothing. When a reported LiveView is also served behind a protecting hook elsewhere, the message names that route: its events likely assume a signed-in user. With the default :auto, modules whose name contains Auth count, and the check reports only when some route uses one, so projects that authenticate another way see no findings. List intentionally public routes in public_paths (route patterns such as "/posts/:id", or regexes). Routes to LiveViews defined outside the project's sources, such as LiveDashboard and Oban Web, are skipped: their router macros take their own on_mount option.

Confidence: high. Tier: semantic (run mix compile before mix credo).

Check-Specific Parameters

Use the following parameters to configure this check:

:excluded_paths

Paths to skip (atoms, binaries as path segments, or regexes).

This parameter defaults to [~r/\/test\//, "test"].

:strict

Unused.

This parameter defaults to false.

:auth_hooks

:auto, or the hook modules (atoms or regexes) that authenticate.

This parameter defaults to :auto.

:public_paths

Route paths that need no authentication: binaries or regexes.

This parameter defaults to [].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.