Paths/Backend Engineer/Authentication & Authorisation / Passwords & Sessions
Define a Password Policy
How you store a password decides whether a breach is a nuisance or a catastrophe. Write the hashing policy your service will follow.
Validator
IDLE — checks run live as you type commands; submit when done
01Requirements
live checks- Directory ~/.auth exists○
- File ~/.auth/password-policy.yaml exists○
- The policy names the hashing algorithm and its cost○
- The policy states the minimum length and the salt rule○
02Walkthrough
4 steps- 01
Create the auth directory
One directory holds the security configuration for the whole service.
mkdir -p ~/.auth - 02
Write the hashing policy
argon2id with a memory cost is the modern default - it is deliberately slow, which is the point.
echo 'passwords:\n algorithm: argon2id\n cost: 19\n memory_kib: 65536\n parallelism: 1' > ~/.auth/password-policy.yaml - 03
Add the length and salt rules
A minimum length beats a complexity rule, and every hash gets its own random salt - never a global one.
echo '\n min_length: 12\n max_length: 200\n salt: per_password_random\n pepper: secret_manager' >> ~/.auth/password-policy.yaml - 04
Verify and submit
cat the policy, then submit for validation.
cat ~/.auth/password-policy.yaml
03Stuck?
0 of 3 revealedTake a hint without losing the lab — each one points at the thing to look at, not at the answer.
04AI Tutor
guides, never solvesTell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?
04Notebook
saved locally in this browserlearner@lab — ubuntu:24.04
Session is disposable
↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list