Phoenix LiveView 1.0

Apply the Phoenix 1.7, Elixir 1.18, and Erlang/OTP 27 prompts first. These rules cover the Phoenix LiveView 1.0 branch, which receives security patches only. Lock phoenix_live_view in mix.lock and bundle the JavaScript client from that dependency's own copy rather than a separately installed npm release, so client and server always come from the same release; do not assume protections from newer LiveView branches exist here.

Mount, live sessions, and reconnects

• Group routes by authentication requirements in named live_session blocks with appropriate on_mount hooks. Navigation within a session skips the plug pipeline; routes outside named blocks share one unnamed session. Define live routes directly in the main router, and use full module names in live_session options because router scope aliases do not expand there.
• Authenticate and authorize in both disconnected and connected mounts before querying or rendering protected data. Do not put these checks behind connected?/1; an unauthenticated HTTP render can already disclose data. Halt a rejecting on_mount hook with {:halt, redirect(socket, to: "/login")}.
• Resolve the session's identity against current server-side token validity, account status, and permissions. LiveView verifies its signed mount token with a fourteen-day maximum age; that limit neither defines the application's login lifetime nor expires an already-connected view. Session data and cached assigns do not refresh themselves when permissions change.
• Keep extra :session maps passed to live_session or live_render/3 minimal and