Controllers mod_authentication

controller_authentication

This controller manages all authentication cookies. It is called by the auth model in the browser.

It accepts POST requests and dispatches commands including logon, logoff, session refresh, automatic-logon configuration, password changes and resets, user switching, one-time tokens, and authentication status. Responses use the same JSON, UBF, or BERT representation negotiated by the request.

Referred by

Developer guide

Keep permission checks at the boundary

Use the request context when checking access to data and actions. A hidden button is not an authorization check: callers can invoke a model or endpoint…

Controllers

controller_mqtt_transport

Controller for transport of MQTT data between the browser (client) and server.

controller_logon_done

This controller is used as a jumping stone after a log on from the /logon page. The p argument is passed from the /logon page.

controller_logoff

Controller that logs off a user, destroying the session. It also removes any “remember me” cookies the user has, so that auto-logon is…

observe_auth_confirm_done/2

A user id has been confirmed.

observe_auth_validate/2

First to validate a password. Return {ok, RscId} or {error, Reason}.

observe_auth_postcheck/2

First for logon of user with username, called after successful password check.

observe_auth_precheck/2

First for logon of user with username, check for ratelimit, blocks etc.

authentication

Model for authentication state and login support checks, including password authentication flow helpers and reminder/verification actions.

observe_auth_logoff/3

User is about to log off. Modify (if needed) the logoff request context.

observe_logon_ready_page/2

Check where to go after a user logs on.