# `Soundcheck.Check.Warning.LiveRouteWithoutAuthHook`
[🔗](https://github.com/leonqadirie/soundcheck/blob/v0.1.0/lib/soundcheck/check/warning/live_route_without_auth_hook.ex#L1)

## Basics

> #### This check is disabled by default. {: .neutral}
>
> [Learn how to enable it](`e:credo:config_file.html#checks`) via `.credo.exs`.

This check has a base priority of `high` and works with any version of Elixir.

## Explanation

Flags live routes that run no authentication `on_mount` hook. Plugs
in the router pipeline guard only the first HTTP request; a client
navigating over an open socket reaches the LiveView without them, so
each live_session needs its own `on_mount` check.

Before:

    live_session :admin do
      live "/admin", AdminLive
    end

After:

    live_session :admin, on_mount: [{MyAppWeb.UserAuth, :require_authenticated}] do
      live "/admin", AdminLive
    end

A hook counts when its module matches `auth_hooks` (atoms or regexes),
whether it comes from the route's live_session or the LiveView's own
`on_mount`, and when its compiled `on_mount/4` clause for the hook's
argument can stop the mount: return `{:halt, socket}` or raise. A hook
that provably always continues, such as phx.gen.auth's
`:mount_current_scope`, only loads the user and protects nothing. When
a reported LiveView is also served behind a protecting hook elsewhere,
the message names that route: its events likely assume a signed-in
user. With the default `:auto`, modules whose name contains
`Auth` count, and the check reports only when some route uses one, so
projects that authenticate another way see no findings. List
intentionally public routes in `public_paths` (route patterns such as
`"/posts/:id"`, or regexes). Routes to LiveViews defined outside the
project's sources, such as LiveDashboard and Oban Web, are skipped:
their router macros take their own `on_mount` option.

Confidence: high. Tier: semantic (run `mix compile` before `mix credo`).

## Check-Specific Parameters

Use the following parameters to configure this check:

### `:excluded_paths`

  Paths to skip (atoms, binaries as path segments, or regexes).

*This parameter defaults to* `[~r/\/test\//, "test"]`.

### `:strict`

  Unused.

*This parameter defaults to* `false`.

### `:auth_hooks`

  `:auto`, or the hook modules (atoms or regexes) that authenticate.

*This parameter defaults to* `:auto`.

### `:public_paths`

  Route paths that need no authentication: binaries or regexes.

*This parameter defaults to* `[]`.

## General Parameters

Like with all checks, [general params](`e:credo:check_params.html`) can be applied.

Parameters can be configured via the [`.credo.exs` config file](`e:credo:config_file.html`).

---

*Consult [api-reference.md](api-reference.md) for complete listing*