Created by Ryan Emmans
- Using a tool such as httpie, postman, or a web form:
- Make a POST request to the/signup route with username and password
- Your server should support both JSON and FORM data as input
- On a successful account creation, return a 201 status with the user object in the body
- On any error, trigger your error handler with an appropriate error
- Using a tool such as httpie, postman, or a web form:
- Make a POST request to the /signin route
- Send a basic authentication header with a properly encoded username and password combination
- On a successful account login, return a 200 status with the user object in the body
- On any error, trigger your error handler with the message “Invalid Login”
Any user that has successfully logged in using basic authentication (username and password) is able to continuously authenticate … using a “token”
- Using a tool such as httpie, postman, or a web form:
- Following a POST to
/signup
to create an account (or) Following a POST to `/signin with basic authorization-
Send a response to the client with the proper status code along with an object with the following properties
{ user: { _id: 'ID FROM DB', username: 'myusername' }, token: 'JWT Token Here' }
-
- Following a POST to
- Using httpie or postman, send a request to a “protected” route, such as
/secretstuff
- Your request must send an “Authorization” header, with the value of Bearer TOKEN
- TOKEN is the token that you would have returned to the user after their signin step (above)
- If the TOKEN is valid (i.e. if it represents an actual user) The route should function as it normally would (sending a response)
- If not
- Send the user an error message stating “Invalid Login”
- Your request must send an “Authorization” header, with the value of Bearer TOKEN
As the website owner, I want our token system to be as secure as possible so that our users can feel safe when logging in
- Research ways to “secure” our JWT Tokens
- Implement one or more methods to secure our login tokens
- POST route for
/signup
- Accepts either a JSON object or FORM Data with the keys “username” and “password”.
- Creates a new user record in a Postgres database.
- Returns a 201 with the created user record.
- POST route for
/signin
- Use your basic authentication middleware to perform the actual login task.
router.post('/signin', basicAuth, (req,res) => {});
- When validated, send a JSON object as the response with the following properties:
user
: The users’ database record
- GET route for
/secret