# Programming Phoenix LiveView B10.0: Confused about Protecting Sensitive Routes (pages 52 - 60)

**URL:** <https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789>\
**Category:** PragProg Customers\
**Tags:** book-programming-phoenix-liveview, question\
**Created:** [31 December 2023 02:57 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789 "2023-12-31T02:57:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![GumptionWare](https://forum.devtalk.com/user_avatar/forum.devtalk.com/gumptionware/32/4415_2.png) [@GumptionWare](https://forum.devtalk.com/u/GumptionWare)\
**Post date:** [31 December 2023 02:57 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789/1 "2023-12-31T02:57:20Z")

</div>

On page 52, the topic of “Protecting Sensitive Routes” is introduced with this snippet from `router.ex`:

```auto
scope "/", PentoWeb do
  pipe_through [:browser, :require_authenticated_user]

  live_session :require_authenticated_user,
    on_mount: [{PentoWeb.UserAuth, :ensure_authenticated}] do 
     live "/users/settings", UserSettingsLive, :edit
     live "/users/settings/confirm_email/:token",
       UserSettingsLive, :confirm_email 
     live "/guess", WrongLive
   end
end

```

Then on page 60, the following snippet is shown for `router.ex`:

```auto
scope "/", PentoWeb do
  pipe_through [:browser, :require_authenticated_user]

  live_session :require_authenticated_user,
    # Specify the shared on_mount callback here
    on_mount: [{PentoWeb.UserAuth, :ensure_authenticated}] do
      live "/users/settings", UserSettingsLive, :edit
      live "/users/settings/confirm_email/:token",
        UserSettingsLive, :confirm_email 
      live "/guess", WrongLive
  end 
end

```

The only difference I can see is the addition of the `# Specify the shared on_mount callback here` comment.

So what I am confused by is what has changed that enables us to remove the `user = Accounts.get_user_by_session_token(session["user_token"])`, `session_id: session["live_socket_id"],` and `current_user: user` lines from `wrong_live.ex` per this guidance on page 60: “With this in place, we can remove the auth code from the WrongLive’s own mount function.”

I have re-read this section several times, but I am still not understanding what that comment (`# Specify the shared on_mount callback here`) means, since those two `router.ex` code snippets are otherwise identical.

---

<div class="post-metadata">

**Author:** ![tma\_1](https://forum.devtalk.com/letter_avatar_proxy/v4/letter/t/ecd19e/32.png) [@tma\_1](https://forum.devtalk.com/u/tma_1)\
**Post date:** [31 January 2024 15:42 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789/2 "2024-01-31T15:42:34Z")

</div>

This confused me too.I think this is an error in the book. They don’t add any auth code to the WrongLive mount function. Maybe in some draft they did and then decided not to include it? Instead on pg 59 they say:

“While we could implement the appropriate logic in the live view’s mount function, that would leave us on the hook for implementing that same logic in every live view in our live session.”

---

<div class="post-metadata">

**Author:** ![longnight](https://forum.devtalk.com/user_avatar/forum.devtalk.com/longnight/32/6741_2.png) [@longnight](https://forum.devtalk.com/u/longnight)\
**Post date:** [10 November 2024 03:42 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789/3 "2024-11-10T03:42:30Z")

</div>

When I finished this chapter , I still got a full reflash of the whole page when navigated from `/setting` to `/guess` , instead of it said that "… shared root layout without re-render ". Are you resulted the same ?

---

<div class="post-metadata">

**Author:** ![SophieDeBenedetto](https://forum.devtalk.com/user_avatar/forum.devtalk.com/sophiedebenedetto/32/2521_2.png) [@SophieDeBenedetto](https://forum.devtalk.com/u/SophieDeBenedetto)\
**Post date:** [10 December 2024 16:12 UTC](https://forum.devtalk.com/t/programming-phoenix-liveview-b10-0-confused-about-protecting-sensitive-routes-pages-52-60/137789/4 "2024-12-10T16:12:35Z")

</div>

Thanks for all the feedback! The upcoming beta release of the book should include the following:

- An initial version of the mount function in GuessLive that looks up the current user and adds them to socket assigns
- A clarification that the ‘guess’ live route will already be added to the live session that uses the generated ensure\_authenticated on\_mount function from the start