1. 選擇Session or JWT勇婴？

關(guān)于Session和JWT的區(qū)別和聯(lián)系伟众，可以看以下兩篇文章：
[1] 什么是 JWT -- JSON WEB TOKEN
[2] 服務(wù)器session和jwt之爭
[3] cookie session，jwt，弱一致性數(shù)據(jù)與重放攻擊
[4] 為什么 APP 要用 token 而不用 session 認(rèn)證？

總結(jié)，Web端用session+https沒有什么問題输涕，session注意加密即可。App/API端用JWT慨畸，注意實(shí)現(xiàn)的方式莱坎，jwt存在的目的是防止每次認(rèn)證都hit database。

2. überauth

überauth是一個(gè)基于Plug的Elixir Web應(yīng)用認(rèn)證系統(tǒng)寸士。

如果你熟悉 Ruby 你可以把 Plug 想成 Rack檐什，再加上一點(diǎn) Sinatra。它提供了編寫 Web 應(yīng)用組件的一組規(guī)范弱卡，以及接入 Web 服務(wù)器所需的一些適配器乃正。雖然 Plug 不屬于 Elixir 的核心庫，但它依然是一個(gè) Elixir 官方維護(hù)的項(xiàng)目婶博。

關(guān)于Plug的更多介紹瓮具，可以參考以下兩個(gè)鏈接：
[1] Plug Documentation
[2] Elixir School Plug

Ueberauth是一個(gè)兩步認(rèn)證框架，它提供了清晰的API凡人，允許社區(qū)自定義許多認(rèn)證策略名党。它深受Omniauth項(xiàng)目的啟發(fā)，概念類似划栓，但是實(shí)現(xiàn)上不同兑巾。Ueberauth提供的僅是初始的認(rèn)證（初始OAuth流，從登錄表單獲取信息等）忠荞，它并不會(huì)認(rèn)證每個(gè)請求，這交給你應(yīng)用來實(shí)現(xiàn)帅掘。你可以指定一個(gè)token或者把應(yīng)用需要的結(jié)果放到session中委煤。可以通過Guardian等來幫助你應(yīng)用層面的認(rèn)證修档，即請求級別的認(rèn)證碧绞。

兩個(gè)階段是request和callback，這些階段由策略Strategies實(shí)現(xiàn)吱窝。

2.1 Strategies 策略

Strategies是Plug讥邻，用來裝飾攔截請求迫靖。

Strategies實(shí)現(xiàn)了兩個(gè)步驟，然后允許request流過下面的plugs兴使。根據(jù)strategies需求系宜，實(shí)現(xiàn)request和callback兩步是可選的。如果strategy不重定向发魄，請求會(huì)裝飾以Ueberauth的信息盹牧，并在pipeline中傳遞。

目前Strategies分為Provider Strategies和Developer Strategies：

Provider Strategies

• Facebook - Authenticate using the Facebook API.
• GitHub - Authenticate using the GitHub API.
• Google - Authenticate using the Google API.
• Paypal - Authenticate using the Paypal API.
• Slack - Authenticate using the Slack API.
• Twitter - Authenticate using the Twitter API.
• vk.com - Authenticate using the VK API.
• Weibo - Authenticate using the Weibo API.

Developer Strategies

• Identity - A basic username/password strategy.

2.2 Request Phase 請求步驟

The request phase is where you request information about the user. This could be a redirect to an OAuth2 authorization url or a form for collecting username and password. The request phase is concerned with only the collection of information. When a request comes in on the request phase url the relevant strategy will receive the handle_request! call.

請求步驟會(huì)請求用戶信息励幼。這一步會(huì)跳轉(zhuǎn)到OAuth2認(rèn)證url或者一個(gè)包含用戶名密碼的表單汰寓。請求步驟只關(guān)注信息。

2.3 Callback Phase 回調(diào)步驟

The callback phase is where the fun happens. Once a successful request phase has been completed, the request phase provider (OAuth provider or host site, etc) should call the callback URL. The strategy will intercept the request via the callback_phase!
. If successful, it should prepare the connection so the Ueberauth.Auth
struct can be created, or set errors to indicate a failure.

一旦請求步驟成功苹粟，請求步驟服務(wù)商（OAuth或者主站）會(huì)請求回調(diào)URL有滑。這個(gè)策略會(huì)攔截callback_phase!的請求。如果成功嵌削，它會(huì)準(zhǔn)備好連接俺孙，Ueberauth.Auth結(jié)構(gòu)體被創(chuàng)建，如果失敗掷贾，則報(bào)錯(cuò)睛榄。

3. Guardian

An authentication framework for use with Elixir applications.
Guardian is based on similar ideas to Warden but is re-imagined for modern systems where Elixir manages the authentication requirements.

Guardian remains a functional system. It integrates with Plug, but can be used outside of it. If you're implementing a TCP/UDP protocol directly, or want to utilize your authentication via channels, Guardian is your friend.

The core currency of authentication in Guardian is JSON Web Tokens (JWT). You can use the JWT to authenticate web endpoints, channels, and TCP sockets and it can contain any authenticated assertions that the issuer wants to include.

正如上面介紹的，Guardian為你應(yīng)用請求進(jìn)行認(rèn)證想帅，它并不校驗(yàn)密碼或是從OAuth服務(wù)商獲取信息场靴。你可以通過überauth或者構(gòu)建自己的email/password認(rèn)證基于Comeonin。Guardian只處理每個(gè)請求的認(rèn)證港准。
Guardian looks after authenticating each request to your application. It doesn't do the initial checking of passwords or fetching information from an OAuth provider. For that you can use something like überauth or roll your own email/password using something like Comeonin. Guardian handles each request authentication. Challenging users and confirming their credentials is up to your application. Guardian assumes that you have a user representation that you've confirmed already.

[1] http://blog.overstuffedgorilla.com/simple-guardian/

4. 其他框架

Openmaize
coherence - ExAdmin作者提供的用戶登錄注冊系統(tǒng)
openmaize - 基于JWT的用戶認(rèn)證

5. 擴(kuò)展閱讀

[1] Phoenix Guardian 示例項(xiàng)目
[2] http://blog.overstuffedgorilla.com/
[3] https://www.youtube.com/watch?v=X6Z-sDSJ3sE