Using authOptional in :api pipelines

[LuchoTurtle]

I'm trying to use this plug in an :api pipeline.

Having read the documentation, doing

pipeline :authoptional, do: plug(AuthPlugOptional, %{})

should be enough to get up and going.
Adding this pipeline to the scope should be fairly simple, like so:

  scope "/api", AppWeb do
    pipe_through [:api, :authOptional]

    resources "/items", ItemController, only: [:create, :update]
  end

However, I keep stumbling upon this error when calling the app anonymously.

session not fetched, call fetch_session/2

This error doesn't occur when I add a Bearer Token, for example.

This error occurs in auth_plug and I've located where. The error is in get_jwt, when calling get_session..

It's weird, this error shouldn't be happening according to the Conn.Plug's source code, since the :jwt atom is being passed.

I'm aware this could easily be surpassed by just creating the authOptional pipeline with a plug:fetch_session, like so:

  pipeline :authOptional do
    plug :fetch_session
    plug(AuthPlugOptional)
  end

However, I feel like auth_plug should gracefully handle these scenarios.

Should a guard be added in get_jwt? Or is it the user's responsibility to fetch_session in their :authOptional pipelines?

[nelsonic]

@LuchoTurtle great question, thank you for asking/opening it. 👌
I’ve wondered the same in the past and opted for allowing each consuming app to implement the :fetch_session but if there was no negative side effect of doing it in auth_plug is be happy to include it in the library. 💭

[LuchoTurtle]

I've pondered about this and tried to find a way to handle this but perhaps it's best for the user to do the fetching of the session themselves.

Auth_plug shouldn't fetch the session just to verify if it exists. This will cause fetching the session two times when using a browser pipeline, which is not really bueno.

[nelsonic]

Exactly. Thanks for confirming. 👌

[nelsonic]

@LuchoTurtle do you want to add a brief section on how to use auth_plug in an API pipeline to the README.md? 🙏

[LuchoTurtle]

Just created #102 to briefly explain how to use this package with APIs. Nothing biggie, just a clarification.

[nelsonic]

Thanks very much @LuchoTurtle 👍