1. 選擇Session or JWT？
關于Session和JWT的區別和聯系，可以看以下兩篇文章：
[1] 什么是 JWT -- JSON WEB TOKEN
[2] 服務器session和jwt之爭
[3] cookie session，jwt，弱一致性數據與重放攻擊
[4] 為什么 APP 要用 token 而不用 session 認證？
總結，Web端用session+https沒有什么問題，session注意加密即可。App/API端用JWT，注意實現的方式，jwt存在的目的是防止每次認證都hit database。
2. überauth
überauth是一個基于Plug的Elixir Web應用認證系統。
如果你熟悉 Ruby 你可以把 Plug 想成 Rack，再加上一點 Sinatra。它提供了編寫 Web 應用組件的一組規范，以及接入 Web 服務器所需的一些適配器。雖然 Plug 不屬于 Elixir 的核心庫，但它依然是一個 Elixir 官方維護的項目。
關于Plug的更多介紹，可以參考以下兩個鏈接：
[1] Plug Documentation
[2] Elixir School Plug
Ueberauth是一個兩步認證框架，它提供了清晰的API，允許社區自定義許多認證策略。它深受Omniauth項目的啟發，概念類似，但是實現上不同。Ueberauth提供的僅是初始的認證（初始OAuth流，從登錄表單獲取信息等），它并不會認證每個請求，這交給你應用來實現。你可以指定一個token或者把應用需要的結果放到session中。可以通過Guardian等來幫助你應用層面的認證，即請求級別的認證。
兩個階段是request和callback，這些階段由策略Strategies實現。
2.1 Strategies 策略
Strategies是Plug，用來裝飾攔截請求。
Strategies實現了兩個步驟，然后允許request流過下面的plugs。根據strategies需求，實現request和callback兩步是可選的。如果strategy不重定向，請求會裝飾以Ueberauth的信息，并在pipeline中傳遞。
目前Strategies分為Provider Strategies和Developer Strategies：
Provider Strategies
- Facebook - Authenticate using the Facebook API.
- GitHub - Authenticate using the GitHub API.
- Google - Authenticate using the Google API.
- Paypal - Authenticate using the Paypal API.
- Slack - Authenticate using the Slack API.
- Twitter - Authenticate using the Twitter API.
- vk.com - Authenticate using the VK API.
- Weibo - Authenticate using the Weibo API.
Developer Strategies
- Identity - A basic username/password strategy.
2.2 Request Phase 請求步驟
The request phase is where you request information about the user. This could be a redirect to an OAuth2 authorization url or a form for collecting username and password. The request phase is concerned with only the collection of information. When a request comes in on the request phase url the relevant strategy will receive the handle_request! call.
請求步驟會請求用戶信息。這一步會跳轉到OAuth2認證url或者一個包含用戶名密碼的表單。請求步驟只關注信息。
2.3 Callback Phase 回調步驟
The callback phase is where the fun happens. Once a successful request phase has been completed, the request phase provider (OAuth provider or host site, etc) should call the callback URL. The strategy will intercept the request via the callback_phase!
. If successful, it should prepare the connection so the Ueberauth.Auth
struct can be created, or set errors to indicate a failure.
一旦請求步驟成功，請求步驟服務商（OAuth或者主站）會請求回調URL。這個策略會攔截callback_phase!的請求。如果成功，它會準備好連接，Ueberauth.Auth結構體被創建，如果失敗，則報錯。
3. Guardian
An authentication framework for use with Elixir applications.
Guardian is based on similar ideas to Warden but is re-imagined for modern systems where Elixir manages the authentication requirements.
Guardian remains a functional system. It integrates with Plug, but can be used outside of it. If you're implementing a TCP/UDP protocol directly, or want to utilize your authentication via channels, Guardian is your friend.
The core currency of authentication in Guardian is JSON Web Tokens (JWT). You can use the JWT to authenticate web endpoints, channels, and TCP sockets and it can contain any authenticated assertions that the issuer wants to include.
正如上面介紹的，Guardian為你應用請求進行認證，它并不校驗密碼或是從OAuth服務商獲取信息。你可以通過überauth或者構建自己的email/password認證基于Comeonin。Guardian只處理每個請求的認證。
Guardian looks after authenticating each request to your application. It doesn't do the initial checking of passwords or fetching information from an OAuth provider. For that you can use something like überauth or roll your own email/password using something like Comeonin. Guardian handles each request authentication. Challenging users and confirming their credentials is up to your application. Guardian assumes that you have a user representation that you've confirmed already.
[1] http://blog.overstuffedgorilla.com/simple-guardian/
4. 其他框架
Openmaize
coherence - ExAdmin作者提供的用戶登錄注冊系統
openmaize - 基于JWT的用戶認證
5. 擴展閱讀
[1] Phoenix Guardian 示例項目
[2] http://blog.overstuffedgorilla.com/
[3] https://www.youtube.com/watch?v=X6Z-sDSJ3sE
