Phoenix LiveView 1.2

Apply the Phoenix 1.8 prompt and its Elixir and Erlang/OTP baselines first. These rules cover LiveView mounts, events, components, uploads, client hooks, and long-lived socket state.

Mount and reconnect authorization

• Authenticate and load identity with on_mount or equivalent hooks on both disconnected and connected mounts.
• Authorize the current tenant and resource again after the WebSocket connects; disconnected render state is not sufficient authority.
• Treat params, session data, connect parameters, URI, and client metadata as untrusted even when they were signed or previously rendered.
• Recheck permissions after navigation, reconnect, impersonation changes, and other identity or tenant transitions. Set live_socket_id in the session so logout and revocation broadcasts can disconnect every affected LiveView.
• Use separate live_session groups for different authentication requirements; navigation within a group skips router plugs.

Events and components

• Pattern-match and validate every handle_event/3 payload before lookup or mutation.
• Authorize the actual loaded object for every event instead of trusting DOM IDs, component IDs, or hidden values.
• Treat LiveComponents as shared server code, not authorization boundaries, and pass only the minimum trusted assigns.
• Keep privileged actions out of generic event-name dispatch and never convert an event string to a module, function, or atom.

Rendering and client trust

• Render attacker content through HEEx escaping and avoid raw/1, unsafe fragments, and client-produced HTML.
• Treat hidden