Authentication & Authorization Chapter 11 · Backend Development
~2 weeks 2 tutorials Midterm 4
Security is non‑negotiable. This unit covers the full spectrum of authentication and
authorization: hashing passwords with bcrypt, JSON Web Tokens (JWT), session management,
OAuth2 flows, and role‑based access control (RBAC). You will learn to secure your
APIs against common threats.
Unit Learning Outcomes
Implement secure password hashing with bcrypt.
Generate and verify JSON Web Tokens (JWT) for stateless authentication.
Set up session‑based authentication with Express sessions.
Integrate OAuth2 (Google, GitHub) using Passport.js.
Implement role‑based access control (RBAC) and middleware guards.
Protect APIs against common vulnerabilities (OWASP Top 10).