One page
Auth and security cheat sheet
What to keep at hand. If a line is not clear, go back to the matching lesson in the course.
Open the course: Auth and securitySessions and passwords
| What | How |
|---|---|
| Cookie | HttpOnly; Secure; SameSite=Lax |
| Password hash | await bcrypt.hash(password, 12) |
| Checking | await bcrypt.compare(input, hash) |
Tokens and defenses
| What | How |
|---|---|
| Issue a JWT | jwt.sign({ sub: id }, SECRET, { expiresIn: "15m" }) |
| Header | Authorization: Bearer <token> |
| CORS | cors({ origin: ["https://app.example"], credentials: true }) |
| SQL | db.query("… WHERE email = $1", [email]) |
Permissions and hardening
| What | How |
|---|---|
| Permission | can(user, "posts:delete") |
| Random token | randomBytes(32).toString("base64url") |
| Sign in with Google | response_type=code&scope=openid email |
| HTTPS only | Strict-Transport-Security: max-age=31536000 |
| Script sources | Content-Security-Policy: default-src 'self' |