Week 9: Authentication & Security

Security

Implement user authentication, authorization, and security best practices for web applications.

Learning Objectives

Detailed Schedule

Session 1: Authentication Fundamentals (1 hour)

Authentication Basics (25 minutes)

  • Authentication vs Authorization
  • Password hashing and salting
  • Session-based vs Token-based auth
  • JWT (JSON Web Tokens) fundamentals

JWT Implementation (20 minutes)

  • JWT token structure and payload
  • Token signing and verification
  • Token refresh mechanism

Practice Exercise (15 minutes)

Implement JWT token generation, verification, and refresh mechanism

Session 2: User Registration & Authorization (1 hour)

User Authentication System (25 minutes)

  • User registration with validation
  • Password hashing with bcrypt
  • User login and token generation
  • Error handling for auth operations

Authorization & Middleware (20 minutes)

  • Authentication middleware
  • Role-based access control (RBAC)
  • Protected route implementation

Practice Exercise (15 minutes)

Build complete user registration and login system with password hashing

Session 3: Security Best Practices (1 hour)

Security Fundamentals (25 minutes)

  • Input validation and sanitization
  • SQL injection prevention
  • XSS (Cross-Site Scripting) protection
  • CSRF (Cross-Site Request Forgery) protection

Advanced Security (20 minutes)

  • Rate limiting and throttling
  • Environment variables and secrets
  • Security headers implementation
  • Error handling and logging

Practice Exercise (15 minutes)

Apply security best practices including validation, rate limiting, and headers

Key Concepts

Authentication

  • • JWT token-based authentication
  • • Password hashing with bcrypt
  • • User registration and login
  • • Token refresh mechanism

Authorization

  • • Role-based access control
  • • Permission-based authorization
  • • Protected routes and middleware
  • • User-specific data access

Security

  • • Input validation and sanitization
  • • XSS and CSRF protection
  • • Rate limiting and throttling
  • • Security headers

Best Practices

  • • Environment variables
  • • Error handling
  • • Logging and monitoring
  • • Security testing

Hands-on Activities

Activity 1: JWT Implementation

Implement JWT token generation, verification, and refresh mechanism.

Token Generation Token Verification Token Refresh

Activity 2: User Authentication

Build complete user registration and login system with password hashing.

User Registration Password Hashing Login System

Activity 3: Authorization System

Implement role-based access control and protected routes.

RBAC Implementation Protected Routes Middleware

Activity 4: Security Hardening

Apply security best practices including validation, rate limiting, and headers.

Input Validation Rate Limiting Security Headers

Weekly Project: Secure Task Management API

Project Overview

Enhance the Task Management API with comprehensive authentication, authorization, and security features.

Security Features:

  • JWT-based user authentication
  • Role-based access control (Admin, User)
  • Password hashing and validation
  • Email verification system
  • Password reset functionality
  • Rate limiting and security headers

Technical Requirements:

  • JWT token management
  • bcrypt password hashing
  • Authentication middleware
  • Authorization middleware
  • Input validation and sanitization
  • Security testing and audit

Enhanced Project Structure: 

secure-task-api/
├── src/
│   ├── models/
│   │   ├── User.js
│   │   └── Task.js
│   ├── routes/
│   │   ├── auth.js
│   │   ├── tasks.js
│   │   └── users.js
│   ├── middleware/
│   │   ├── auth.js
│   │   ├── authorization.js
│   │   ├── validation.js
│   │   ├── rateLimiter.js
│   │   └── security.js
│   ├── utils/
│   │   ├── jwt.js
│   │   ├── bcrypt.js
│   │   └── email.js
│   ├── config/
│   │   ├── database.js
│   │   └── security.js
│   └── app.js
├── tests/
│   ├── auth.test.js
│   ├── tasks.test.js
│   └── security.test.js
├── package.json
└── README.md

Assessment Criteria

Technical Skills (60%)

  • JWT implementation (20%)
  • User authentication system (20%)
  • Authorization and middleware (15%)
  • Security best practices (5%)

Project Quality (40%)

  • Authentication functionality (15%)
  • Security implementation (15%)
  • Error handling and validation (10%)

Teaching Resources

Code Examples:

Additional Resources: