Phoenix 1.8

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. When the application uses Ecto or LiveView, also apply the Ecto or Phoenix LiveView prompt for its installed version.

Router and plug boundaries

• Put authentication, authorization context, CSRF, rate limits, and security headers in pipelines that cover every intended route and method.
• Review pipe_through, scoped routers, forwarding, custom plugs, and early halt/1 paths so protected handlers cannot bypass required plugs.
• Authorize the loaded tenant and object in the controller or context, not only the route, scope, or UI.
• Restrict parsers, accepted media types, body length, query depth, and multipart handling before controller work begins.
• Keep put_secure_browser_headers/2; its default CSP restricts only base-uri and frame-ancestors, so configure an application-specific script policy.

Sessions, CSRF, and origins

• Sign and encrypt session contents as required, keep them minimal, and rotate secret_key_base and signing salts through a planned invalidation path. Generated cookie sessions are signed but not encrypted unless encryption_salt is set.
• Set session cookies with secure, http_only, an intentional same_site, a narrow path and domain, and bounded lifetime. Never build cookie path, domain, or SameSite values from request data; if a value must come from outside, reject any ; in it so it can't add cookie attributes.
• Keep Plug.CSRFProtection on browser state-changing routes and never disable it merely to accept API traffic in the same pipeline. Keep GET, HEAD, and OPTIONS