From 875da73177b301ff6e3bbb7395c9e33917cc859a Mon Sep 17 00:00:00 2001 From: Josh Kalderimis Date: Sat, 28 Dec 2024 14:09:36 +1300 Subject: [PATCH] Fetch the signing salt for the web socket connections from the config This approach is taken from https://hexdocs.pm/phoenix/Phoenix.Endpoint.html#socket/3-connect-info ``` Additionally, session_config may be a MFA, such as {MyAppWeb.Auth, :get_session_config, []}, to allow loading config in runtime. ``` This allows for the signing salt to not be published and shared between all running NervesHub installs. --- lib/nerves_hub_web/endpoint.ex | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/nerves_hub_web/endpoint.ex b/lib/nerves_hub_web/endpoint.ex index e3e8c43b6..d553a2628 100644 --- a/lib/nerves_hub_web/endpoint.ex +++ b/lib/nerves_hub_web/endpoint.ex @@ -4,10 +4,14 @@ defmodule NervesHubWeb.Endpoint do alias NervesHub.Helpers.WebsocketConnectionError + def fetch_signing_salt() do + Application.get_env(:nerves_hub, __MODULE__)[:live_view][:signing_salt] + end + @session_options [ store: :cookie, key: "_nerves_hub_key", - signing_salt: "1CPjriVa" + signing_salt: {__MODULE__, :fetch_signing_salt, []} ] socket("/live", Phoenix.LiveView.Socket, websocket: [connect_info: [session: @session_options]])