PedroTech on YouTube · Open on YouTube
Professional practice · Competent · Lesson 37 of 98 · 3 h 3 min video, then about 7 hours of practice
Authentication and authorization
After this you can add sign-in to an application, store passwords safely, and enforce that users can only access their own data.
Why it matters
Authentication is proving who someone is; authorization is deciding what they may do. Juniors usually get the first roughly right with a library and the second dangerously wrong: checking that a user is logged in but not that the record they are editing belongs to them. Use a maintained library for sessions and password hashing rather than writing your own. Then write explicit authorization checks on every endpoint that touches user data, and a test for each that tries to access someone else's record. Trap: storing JWTs in localStorage because a tutorial did. Understand the trade-offs of sessions versus tokens before choosing.
How to use this resource
A complete backend course with JWT auth and Postgres. Focus on the authentication sections.