Phoenix LiveView 1.1

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. Erlang/OTP 29187 lines · 8.9K tokens
  2. Elixir 1.2051 lines · 1.6K tokens
  3. Phoenix 1.859 lines · 2.4K tokens
  4. Phoenix LiveView 1.170 lines · 3.6K tokens
Total367 lines · 16.4K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 113
  • 116
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 296
  • 297
  • 298
  • 299
  • 306
  • 307
  • 311
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 379
  • 384
  • 400
  • 407
  • 427
  • 434
  • 444
  • 470
  • 472
  • 494
  • 497
  • 502
  • 522
  • 532
  • 552
  • 601
  • 602
  • 611
  • 613
  • 614
  • 639
  • 664
  • 674
  • 732
  • 755
  • 770
  • 772
  • 789
  • 799
  • 807
  • 829
  • 834
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 940
  • 942
  • 943
  • 1004
  • 1021
  • 1275
  • 1287
  • 1395

Prompt Preview

Apply the Phoenix 1.8 prompt and its Elixir 1.20 and Erlang/OTP 29 baselines first. These rules cover Phoenix LiveView 1.1 mounts, live sessions, events, forms, navigation, colocated JavaScript, portals, uploads, asynchronous work, and deployment.

Mount, live sessions, and reconnects

  • Authenticate and authorize in mount/3 or on_mount during both the disconnected HTTP render and connected mount, including reconnects. Do not put these checks only inside if connected?(socket); denied data must never enter the initial HTML.
  • Put routes with different authentication requirements in distinct named live_session blocks with appropriate on_mount hooks. Navigation within a session mounts the destination without the plug pipeline; routes outside explicit blocks share one unnamed session. Use fully qualified hook modules because router scope aliases do not expand these arguments, and define live routes in the main router rather than behind forward/4.
  • Resolve session credentials against current login-token expiry, revocation, account status, and permissions. LiveView's fourteen-day signed mount-token verification is separate from application session validity and does not expire an already connected user automatically.
  • Keep extra :session data supplied through live_session or live_render/3 minimal and free of server-only secrets. It is signed into browser-visible data-phx-session, not encrypted; encrypting the Plug cookie does not encrypt this separate token. Signed extra values override matching connection-session keys on connected mount, so do not