The difference between Phoenix Sessions and Phoenix.Token

1
votes

I am reading the programming phoenix book and they are implementing a session based login system, but when browsing the phoenix docs I noticed the Phoenix.Token section which describes itself as the following:

Tokens provide a way to generate and verify bearer tokens for use in Channels or API authentication.

Is this different to Phoenix Sessions? If so what is the difference? If not does phoenix sessions use this?

Also quick side query, phoenix has a secret key base stored in the config files but also a signing_salt in the endpoint... What are the differences between these two aswell?

1
elixirphoenix-framework

1 Answers

1
votes

In practical terms, sessions are used mostly to hold state for browser page requests where tokens are passed via HTTP headers in api calls. Sessions are identified via cookies, where tokens may be looked up against an oauth session/token store etc.