I notice that there has been a thread with the similar title here: Guardian/JWT vs Phoenix.Token? , but it turned into exchanges about why and when (or should you) use JWT and JWT vs. sessions, with the sole mention of Phoenix.Token only on the first post. I’m starting a new thread to ask about what…

After some digging, I’ve found the following sources of information: the issue (#699) about token auth , the corresponding PR (#820) , and the Phoenix.Token documentation itself . I’m writing this mainly as a note for myself, hoping for some clarification, and I figured it might help someone along the …

[image] bobbypriambodo: JWT allows you to encode arbitrary JSON objects as payload, Phoenix.Token uses Erlang terms serialization so you can’t really do that This means what you encode with JWT is only want can be encoded to JSON while Phoenix.Token is able to encode all terms. On the other s…

[image] josevalim: This means what you encode with JWT is only want can be encoded to JSON while Phoenix.Token is able to encode all terms. Actually you’re right. I can use keyword lists, maps and structs as the payload just fine (although the token would be significantly longer the larger yo…

Yes, we use the salt for key derivation and namespacing tokens. Calling it salt, although technically correct, is likely confusing. namespace could be a better name.

[image] bobbypriambodo: Actually you’re right. I can use keyword lists, maps and structs as the payload just fine (although the token would be significantly longer the larger your data is). The Erlang term format (of which I’ve written libraries in other languages that implement it, it is won…

How is Phoenix.Token different from JWT?

Questions & Help Questions

bobbypriambodo November 14, 2016, 12:33pm 6

I see, that explains it. Thanks for your answers, @josevalim

Good auth solutions for Elixir/Phoenix?