PhoenixKitWeb.Users.Session (phoenix_kit v1.7.225)

Controller for handling user session management.

This controller manages user login and logout operations, including:

Creating new sessions via email/password authentication
Handling post-registration and password update flows
Session termination (logout)
GET-based logout for direct URL access

Security Features

Prevents user enumeration by not disclosing whether an email is registered
Supports remember me functionality via UserAuth module
Session renewal on login/logout to prevent fixation attacks

Summary

Functions

add_account(conn, params)

create(conn, params)

delete(conn, params)

get_logout(conn, params)

impersonate(conn, params)

Adds a user to the session stack on an administrator's authority — the "log in as this user" button in the admin area.

remove_account(conn, params)

set_active_account(conn, params)

Functions

add_account(conn, params)

create(conn, params)

delete(conn, params)

get_logout(conn, params)

impersonate(conn, params)

Adds a user to the session stack on an administrator's authority — the "log in as this user" button in the admin area.

The authority checks live in MultiSession.impersonate/2; this action only translates their outcome into a flash. Each refusal says which rule stopped it, because "could not do that" on a support tool is how an operator ends up guessing at permissions.

The precise refusals are for operators, so the actor's authority is settled BEFORE the uuid is resolved. The other order hands every signed-in user — the gate admits all of them, it only asks that the root session be real — a distinct "User not found." for an unused uuid and a different message for a used one, which is an account-existence oracle wearing a support tool's copy.

remove_account(conn, params)

set_active_account(conn, params)