Curriculum
Phase 5
Authentication, Authorization, and Security
Implement who can perform which operation on which resource, and under what conditions. Close off common API security incidents in code.
- Topics
- 10
- topic groups
- Ready
- 105
- implemented tasks
- Total
- 105
- planned tasks
- 01Hash and store the password on user registrationAuto grading / FeedbackSign in
- 02Verify the hashed password on loginAuto grading / FeedbackSign in
- 03Exclude the plaintext password from auth logsAuto grading / FeedbackSign in
- 04Re-hash the new value when the password changesAuto grading / FeedbackSign in
- 05Reject passwords that are too short at registrationAuto grading / FeedbackSign in
- 06Reject passwords consisting only of whitespaceAuto grading / FeedbackSign in
- 07Unify the error returned on login failureAuto grading / FeedbackSign in
- 08Exclude secret fields from the user retrieval responseAuto grading / FeedbackSign in
- 09Don't store password reset tokens in plaintextAuto grading / FeedbackSign in
- 10Move password comparison into a helper to avoid timing leaksAuto grading / FeedbackSign in
- 11Prevent login with the old password after a password changeAuto grading / FeedbackSign in
- 12Extend the password-handling security contract across the users/auth APIAuto grading / FeedbackSign in