Phoenix 1.7

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. Erlang/OTP 27119 lines · 3.4K tokens
  2. Elixir 1.1859 lines · 1.9K tokens
  3. Phoenix 1.768 lines · 2.6K tokens
Total246 lines · 7.9K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 95
  • 113
  • 117
  • 201
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 306
  • 307
  • 311
  • 312
  • 319
  • 338
  • 347
  • 352
  • 362
  • 367
  • 384
  • 400
  • 407
  • 444
  • 470
  • 494
  • 497
  • 502
  • 522
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 674
  • 732
  • 755
  • 770
  • 772
  • 789
  • 799
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 940
  • 1275
  • 1287
  • 1395

Prompt Preview

Apply Elixir 1.18 and Erlang/OTP 27 first. Phoenix 1.7 gets security patches only, no bug fixes. Elixir 1.11+/OTP 22.1+ are compatibility minimums; select safe runtimes through the OTP prompt's version rule. When using Ecto or LiveView, apply the Ecto or Phoenix LiveView prompt for its installed version.

Router pipelines and route reachability

  • Generated :api pipelines run only plug :accepts, ["json"]; add authentication, token/CSRF checks, rate limiting before state changes.
  • Keep :fetch_session before :protect_from_forgery in browser pipelines: Plug.CSRFProtection needs fetched sessions.
  • Enforce authentication/authorization before or inside forward/4: preceding pipelines run, later routes do not.
  • Pair live_session with on_mount: socket reconnections skip pipe_through.
  • Authorize loaded records in actions/mounts: pipe_through/live_session gate routes, never parameter identifiers.

Verified routes, redirects, and HEEx rendering

  • Use Phoenix.VerifiedRoutes ~p links; reserve unverified_path/3/unverified_url/3 for destinations outside the router.
  • Never pass input to redirect(external: ...): it bypasses :to local-path validation, permitting open redirects.
  • Interpolate input in HEEx expressions, never assembled markup. Review every raw/1 and custom Phoenix.HTML.Safe.
  • Reject javascript:, data:, vbscript: before user URLs reach <.link href={...}>.
  • Match response content-type to rendered formats; never serve JSON as browser-parsed HTML.
  • Keep browser :put_secure_browser_headers; add restrictive