Elixir/Phoenix Security Reference

Ash projects: AshAuthentication has its own strategy/token patterns — use the ash-framework skill. CSRF, XSS, and secret management patterns below still apply.

Quick reference for security patterns in Elixir/Phoenix.

Iron Laws — Never Violate These

1. VALIDATE AT BOUNDARIES — Never trust client input. All data through changesets
2. NEVER INTERPOLATE USER INPUT — Use Ecto's ^ operator, never string interpolation
3. NO String.to_atom WITH USER INPUT — Atom exhaustion DoS. Use to_existing_atom/1
4. AUTHORIZE EVERYWHERE — Check in contexts AND re-validate in LiveView events
5. ESCAPE BY DEFAULT — Never use raw/1 with untrusted content
6. SECRETS NEVER IN CODE — All secrets in runtime.exs from env vars
7. LIVEVIEW EVENT PARAMS ARE UNTRUSTED — Users can alter forms, hooks, and every phx-value-* in DevTools. Validate and authorize against server-side state before acting

Quick Patterns

Timing-Safe Authentication