Milestone # 2: Upgrade authentication && api lessons #28807
Description
READ THIS: this is an informal outline for Milestone # 2. this is a living issue i.e. I'll keep editing over. this is not indicative of what the final version of the lessons might cover or where its placed in the course. please refer to the lesson issue for specific details.
GOAL: upgrade auth & api lessons
introduction to auth lesson
- why webapps need auth
- what is auth vs authorization
- auth schemes we'll cover in the curriculum
session based auth lesson
- implement session based auth from scratch, we can discuss how much hand holding we want the lesson to be. EDIT: we won't be too much handhold-y here and trust our learners to figure it out. the lesson will cover high level concepts of session auth with a few code snippets thrown in
- dive into persisting sessions in the database
- explore cookies and its options i.e. 'secure' 'http-only'. most likely will be a separate lesson
- password hashing. preferably a separate lesson, it could be after members-only project, needs discussion
members only project
now learners get to cover members-only project, but its requirements will be revised. It will just be a mini message board project with auth. No rbac i.e. admin. Primary objective of this project will be for learners to implement session auth
private events project
here we ask learners to implement rbac where a user can be "site admin", "event creator", "event attendee", "event speaker". we could instruct to implement separate logins
now they continue learning Prisma and file uploader project
restful apis lesson
- restful apis and how to write them guide, covers stuff like http methods, url conventions
[insert new project here]
add a small project here for learners to practice restful apis
json web tokens lesson
- implement jwts from scratch, again it can be discussed how hand holdeyy we want to be
- handle cors: preferably a separate lesson
[insert new project here]
we could add another small project here for learners to run jwt before diving into refresh tokens
Refresh tokens lesson
- imo we need to cover refresh tokens in the curriculum
blog api project
now learners proceed to the blog api project
sessions vs jwts lesson
- could be a fun lesson, can be discussed
helpful libraries for auth lesson
- here we can cover Passport.js, Lucia or whatever we like