JWT Authentication with Elixir & Phoenix

Architecture

1. Users

   1. Register User

      1. Accept user details like "email", "password", "username" etc. and persist it in the db (PostgreSQL).

   2. Password Hashing

      1. Store irreversible one way hashed password in the db rather than storing the plain tet password, which would be a disaster if you ask me.

   3. Login

      1. Login based on "username" and "password". Validate password w.r.t password hash stored in the db and if everything matches up issue a JWT token for further interaction with the API (protected routes).

   4. Get Authenticated User

      1. Get back the authenticated user w.r.t to token passwed in the authorization header. But avoiding spitting back the password and fetching it altogether from the db, even though it is hashed it still does not make any sense.

   5. Logout

      1. Invalidating a JWT token by storing it against the "user_id" in the db. So that after log out with a particular token, that token can not be used again for accessing private routes. We did this since JWT tokens can not be destroyed they can only be expired when there time comes. So what happens when someone logs out before their token expires? Oxygen for thought.

2. Protected Routes

   1. Implement private routes to maintain an access control list => what can be accessed and what not. For example, a non authenticated user (guest) should not have access to the following apis

      1. Logout

      2. Ping (an example of ping pong Get request to demonstrate private route mechanism).

      3. etc...

3. Postman

   1. Test the REST API with Postman along the way, while developing each route/api.

4. A lot more

   1. We will be learning a lot more than written, about Elixir, Phoenix, PostgreSQL, and creating REST APIs altogether.