Created by Ryan Emmans

• Using a tool such as httpie, postman, or a web form:
  • Make a POST request to the/signup route with username and password
  • Your server should support both JSON and FORM data as input
  • On a successful account creation, return a 201 status with the user object in the body
  • On any error, trigger your error handler with an appropriate error

• Using a tool such as httpie, postman, or a web form:
  • Make a POST request to the /signin route
  • Send a basic authentication header with a properly encoded username and password combination
  • On a successful account login, return a 200 status with the user object in the body
  • On any error, trigger your error handler with the message “Invalid Login”

Any user that has successfully logged in using basic authentication (username and password) is able to continuously authenticate … using a “token”

• Using a tool such as httpie, postman, or a web form:
  • Following a POST to /signup to create an account (or) Following a POST to `/signin with basic authorization

    • Send a response to the client with the proper status code along with an object with the following properties

      {
        user: {
          _id: 'ID FROM DB',
          username: 'myusername'
        },
        token: 'JWT Token Here'
      }

• Using httpie or postman, send a request to a “protected” route, such as /secretstuff
  • Your request must send an “Authorization” header, with the value of Bearer TOKEN
    • TOKEN is the token that you would have returned to the user after their signin step (above)
  • If the TOKEN is valid (i.e. if it represents an actual user) The route should function as it normally would (sending a response)
  • If not
    • Send the user an error message stating “Invalid Login”

• Research ways to “secure” our JWT Tokens
• Implement one or more methods to secure our login tokens

• Heroku Main Branch
• GitHub Actions
• Pull Requests

• POST route for /signup
  • Accepts either a JSON object or FORM Data with the keys “username” and “password”.
  • Creates a new user record in a Postgres database.
  • Returns a 201 with the created user record.
• POST route for /signin
  • Use your basic authentication middleware to perform the actual login task.
  • router.post('/signin', basicAuth, (req,res) => {});
  • When validated, send a JSON object as the response with the following properties:
    • user: The users’ database record
• GET route for /secret