Learning on Web Dev Open is free for all.

Backend Engineering > Proving it works, then shipping itAuth, and something worth protecting
Phase 05Proving it works, then shipping it280 of 434

Auth, and something worth protecting

Add accounts to the service so that two users can each see their own data and neither can see the other's, then prove it with requests.

Solo project150 minAI adversary

Done when

  • Passwords stored with a modern slow hash and never logged
  • Session or token handling with the correct cookie flags and a working logout
  • Ownership enforced inside the query, not as a check afterwards
  • A documented attempt at authorisation bypass, with the requests and the results
  • Reset flow that does not reveal whether an account exists

Nobody marks this for you. It goes into your phase checkpoint, where a person does.

You should now be able to

  • Implement registration, login and logout end to end
  • Enforce ownership on every read and write
  • Demonstrate the enforcement rather than assert it
Ask the community

Loading…

← PreviousThe API behind something realProving it works, then shipping itNext →Writing up the decisions, not the featuresCheckpoint: Backend Engineer