Skip to main content
SITE-API
Curriculum

Phase 5

Authentication, Authorization, and Security

Implement who can perform which operation on which resource, and under what conditions. Close off common API security incidents in code.

Topics
10
topic groups
Ready
105
implemented tasks
Total
105
planned tasks

Topic 5-1

Passwords

Covers hashing, verification, keeping passwords out of logs, resets, and response formatting.

Implemented
12
Passed
0
Planned
12
Environment
pseudo-HTTP / in-memory & mock SQL
Goal
A secure team notes API

Required Tasks

Exercises

  1. 01Hash and store the password on user registrationAuto grading / FeedbackSign in
  2. 02Verify the hashed password on loginAuto grading / FeedbackSign in
  3. 03Exclude the plaintext password from auth logsAuto grading / FeedbackSign in
  4. 04Re-hash the new value when the password changesAuto grading / FeedbackSign in
  5. 05Reject passwords that are too short at registrationAuto grading / FeedbackSign in
  6. 06Reject passwords consisting only of whitespaceAuto grading / FeedbackSign in
  7. 07Unify the error returned on login failureAuto grading / FeedbackSign in
  8. 08Exclude secret fields from the user retrieval responseAuto grading / FeedbackSign in
  9. 09Don't store password reset tokens in plaintextAuto grading / FeedbackSign in
  10. 10Move password comparison into a helper to avoid timing leaksAuto grading / FeedbackSign in
  11. 11Prevent login with the old password after a password changeAuto grading / FeedbackSign in
  12. 12Extend the password-handling security contract across the users/auth APIAuto grading / FeedbackSign in