Category · Node.js
Who you are and what you're allowed
Cookies and sessions, storing passwords, JWT, CORS, common attacks, roles and permissions, sign-in with Google, password reset, 2FA, and security headers. The minimum without which a backend can't go online.
9 lessons96 min
To the first lessonCheatsheet nowTopics, each as its own lesson
01Cookies and sessionsDemoThe server issues a ticket, the browser carries it in every request.
10 min
02Passwords: hash, salt, bcryptYou never store a password. You store a slow, salted hash.
10 min
03JWTA signed token with data. The server stores no session, but revoking is harder.
11 min
04CORSThe browser asks the server: "May this site read your responses?"
9 min
05XSS, SQL injection, CSRFThree classic attacks and one rule: data is not code.
11 min
06Roles and permissionsSigning in is half of it. The other half is what exactly you're allowed to do.
11 min
07Sign in with Google: OAuth 2.0 and OIDCGoogle keeps the password, and your server gets confirmation of who it is.
12 min
08Password reset and one-time tokensA link in an email is a key to the account. Make it short-lived and single-use.
11 min
09Brute force, 2FA, and security headersThe last layers: limit attempts, add a second factor, close browser holes.
11 min0/9 topics open. This is the course intro, not the whole course on one page.
