Authentication & Authorisation
intermediateTopic 9 of 12 in Backend Development
What it is
Authentication verifies who a user is (login). Authorisation determines what they are allowed to do (permissions). Together, they protect your application and its data from unauthorised access.
Why backend developers need it
Almost every app has users. You need to let them sign up, log in, and control what they can access. Getting auth wrong leads to security breaches, so understanding it properly is critical.
What to learn
Password hashing with bcrypt
Session-based authentication
JSON Web Tokens (JWT): creation, validation, refresh
OAuth 2.0 and social login (Google, GitHub)
Role-based access control (RBAC)
Protecting routes and middleware
Secure cookie handling
Common vulnerabilities: CSRF, XSS, token theft
Practice project
Auth System
Add authentication to your Bookshelf API: user registration with hashed passwords, JWT-based login, protected routes (only logged-in users can add books), and role-based access (admins can delete).