[phx.gen.auth] Add enhanced session fixation protection. For applications whichs previously used phx.gen.auth, the following line can be added to the renew_session function in the auth module:
```
  defp renew_session(conn) do
+   delete_csrf_token()

    conn
    |> configure_session(renew: true)
    |> clear_session()
```
Note: because the session id is in a http-only cookie by default, the only way to perform this attack prior to this change is if your application was already vulnerable to an XSS attack, which itself grants more escalated "privileges” than the CSRF fixation.

JavaScript Client Enhancements

Only memorize longpoll fallback for browser session if WebSocket never had a successful connection

Readme

Source

phoenix logo

Peace of mind from prototype to production.

Getting started

See the official site at https://www.phoenixframework.org/.

Install the latest version of Phoenix by following the instructions at https://hexdocs.pm/phoenix/installation.html#phoenix.

Phoenix requires Elixir v1.11+ & Erlang v22.1+.

Documentation

API documentation is available at https://hexdocs.pm/phoenix.

Phoenix.js documentation is available at https://hexdocs.pm/phoenix/js.

Contributing

We appreciate any contribution to Phoenix. Check our CODE_OF_CONDUCT.md and CONTRIBUTING.md guides for more information. We usually keep a list of features and bugs in the issue tracker.

Generating a Phoenix project from unreleased versions

You can create a new project using the latest Phoenix source installer (the phx.new Mix task) with the following steps:

Remove any previously installed phx_new archives so that Mix will pick up the local source code. This can be done with mix archive.uninstall phx_new or by simply deleting the file, which is usually in ~/.mix/archives/.
Copy this repo via git clone https://github.com/phoenixframework/phoenix or by downloading it
Run the phx.new Mix task from within the installer directory, for example:

cd phoenix/installer
mix phx.new dev_app --dev

The --dev flag will configure your new project's :phoenix dep as a relative path dependency, pointing to your local Phoenix checkout:

defp deps do
  [{:phoenix, path: "../..", override: true},

To create projects outside of the installer/ directory, add the latest archive to your machine by following the instructions in installer/README.md

To build the documentation from source:

npm install --prefix assets
MIX_ENV=docs mix docs

To build Phoenix from source:

mix deps.get
mix compile

To build the Phoenix installer from source:

mix deps.get
mix compile
mix archive.build

Building phoenix.js

cd assets
npm install

Important links

#elixir on Libera IRC
elixir-lang Slack channel
Issues tracker
Phoenix Forum (questions and proposals)
Visit Phoenix's sponsor, DockYard, for expert Phoenix Consulting

Copyright and License

Phoenix source code is licensed under the MIT License.

FAQs

What is phoenix?

Is phoenix popular?

Is phoenix well maintained?

Last updated on 11 Apr 2024

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install