Module · Backend Engineer
Authentication & Authorisation
Passwords, sessions, tokens and scopes - who is calling, and what they may do.
TOPIC 01
Passwords & Sessions
Store the hash, not the password, and give the session the settings it deserves.
What you'll practice
- Define a Password Policy — guided · beginner
- Design a Session — practice · intermediate
A command you'll meet
cat ~/.auth/password-policy.yamlAuthentication is the part of a backend people get wrong quietly. Open the task below for the full walkthrough.
Hands-On Tasks in This Topic (2)
Define a Password Policy
How you store a password decides whether a breach is a nuisance or a catastrophe. Write the hashing policy your service will follow.
Design a Session
A session cookie is a bearer token with your name on it. Write the cookie settings and the rule for rotating the session after every privilege change.
TOPIC 02
OAuth & Scopes
Delegated access, the scopes that bound it, and the tokens that carry it.
What you'll practice
- Define the Scopes — practice · intermediate
- Write the Token Policy — challenge · advanced
A command you'll meet
cat ~/.auth/scopes.yamlA scope is a promise about what a token may do. Open the task below for the full walkthrough.
Hands-On Tasks in This Topic (2)
Define the Scopes
Scopes are how an API says what a caller may do. Write the scope catalogue for the orders service, with the exact verbs your routes check.
Write the Token Policy
Short-lived access tokens, rotating refresh tokens, and a revocation path that actually works. Write the policy.