Module 3 · The server: Node, Express and the database Lesson 9 of 15
Authentication done properly
Never store a password. Hash it, and never invent your own hashing or your own session scheme.
The concept
Authentication means the server knows who is asking. You store an email and a HASH of the password — bcrypt — never the password itself, so a stolen database does not hand over everybody's accounts. On a successful login you issue a token or a signed session, and the client sends it with every later request.
Authorisation is the second half and the one freshers forget: being logged in is not the same as being allowed. Before any write, check that the record belongs to this user — if (job.user_id !== req.user.id) return res.status(403). Skipping that check is how one user deletes another's job, and it is the first thing a reviewer looks for in a portfolio project.
Common mistakes
The mistake is protecting pages in the front end and trusting that. Hiding a button is a user-interface decision; anyone can call the endpoint behind it. Every rule belongs on the server, and the front end only decides what to show.
Worked example
bcrypt.hash(password, 10) on sign-up and bcrypt.compare(password, stored) on sign-in — two lines that replace the plain-text password mistake that gets projects rejected.
Your practice task
Add sign-up and sign-in to your API, store only the hash, and write one protected endpoint that refuses a request without a session.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Authentication means the server knows who is asking.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.