Authentication - lesson 1 | HackIndia Skills

Key point

One idea

Auth is not one feature. It is a chain. If one link is weak, the whole sign-in flow becomes easy to break.

Your job is not to invent security. Your job is to use proven tools, make clear choices, and document what you checked.

What goes wrong

Most broken student auth is not broken by advanced hacking. It is broken by simple mistakes: saving plain passwords, trusting the browser too much, leaking secrets, or protecting only the button instead of the server route.

A recruiter inspecting your repo will not expect bank-grade security. They will expect you to know the basic traps and avoid them on purpose.

Common mistake

Common traps

Do not store passwords as plain text. Do not write your own encryption or hashing logic. Do not put API keys, OAuth secrets, JWT secrets, or database URLs in public code.

Do not rely on frontend checks alone. Hiding a dashboard link is not protection. The server must verify the signed-in user before returning private data.

Your to-do

Plan before coding

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

List what users can do before sign-in, like viewing the home page.
List what needs sign-in, like dashboard, profile, orders, or admin pages.
Choose the account method: email and password, OAuth, or both.
Write where secrets will live, usually in environment variables.
Write how you will test logout, expired login, and direct access to protected URLs.

0 of 5 done

Example

README auth plan

Add a small auth section before you build. It keeps you honest and helps a reviewer understand your choices.

You can ask an AI tool to improve the wording, but check that it does not claim features you have not built.

Auth plan

Public routes:
- /
- /login
- /signup

Protected routes:
- /dashboard
- /profile

Auth method:
- Email and password sign-in
- Passwords will not be stored as plain text
- Secrets will be stored in .env and not committed

Checks before submission:
- A logged-out user cannot open /dashboard directly
- Logout removes access to protected routes
- Invalid login shows a safe error message
- Public repo does not contain real secrets

Tip

Use boring tools

Use the auth support that fits your stack. For example, use a known library, framework middleware, or managed provider instead of building crypto yourself.

If you use AI to generate auth code, ask it this: “What security assumptions does this code make?” Then verify the answer against your framework docs.