The Elixir programming language was created by Jose Valim in 2012 as a research project at Plataformatec, the company he worked at the time. You can watch Elixir: The Documentary where he tells in the first person more about the motivations and reasons behind writing it.
Elixir is a functional, concurrent, distributed and general-purpose programming language that is aimed at building high-concurrency, low-latency, fault-tolerant and distributed applications which are highly scalable. Elixir runs in the battle tested (around 30 years) BEAM virtual machine used to implement the Erlang programming language. Phoenix Channels are a core part of the Phoenix Framework for Elixir, and they squeeze out the best Elixir and BEAM have to offer in terms of concurrency and distribution. This translates into being able to handle millions of simultaneous websocket connections.
The integration of Approov within an Elixir Phoenix Channels server will ensure that your API can only be accessed by genuine instances of your mobile app. Scripts and bots will be blocked. This is achieved by adding the Approov SDK to your mobile app. Implementing the Approov Token check in your Elixir code couldn’t be easier because the token is a regular signed JWT. All you need is to use the potatosalad/erlang-jose package to check the expiry time and verify the signature with the secret known only by your Elixir Phoenix Channels server and the Approov cloud service.
To enhance the protection of your Elixir Phoenix Channels further, you can secure each request by using the Approov Token Binding advanced feature of Approov. This allows you to check the binding of a header in the request with the Approov token itself, for example, the user authentication header.
Please follow one of the Quickstart guides in the repo to learn how to integrate Approov into your current Elixir Phoenix Channels project.
If you have any questions around why or how to use Approov in your Elixir Phoenix Channels project, don’t hesitate to contact us.
Paulo Renato is known more often than not as paranoid about security. He strongly believes that all software should be secure by default. He thinks security should be always opt-out instead of opt-in and be treated as a first class citizen in the software development cycle, instead of an after thought when the product is about to be finished or released.
