Login is a common part of web and application development. This article follows a tutorial that introduces several authentication approaches, from password storage to tokens and API access. It outlines the topics covered rather than serving as a current security implementation guide. Security practices and framework recommendations change; consult current, authoritative documentation before building a production login system.
How a login flow works
A user submits login details such as an email address and password. The system checks them against stored account data, authenticates the user if the credentials are valid, and grants access according to the user’s permissions.
Storing passwords in a database
Password storage is a critical part of a login system. The tutorial warns against storing passwords in plain text and introduces protected password storage. In a real system, follow current security guidance for password hashing and credential management; do not treat the wording in an older tutorial as a complete security specification.
Authentication
The system checks whether the submitted credentials match the account. The tutorial mentions email-and-password checks and two-factor authentication as a way to add another verification step.
Keeping a user signed in with a token
After authentication succeeds, a system may retain information that identifies the signed-in session. The tutorial calls this a token and mentions storing or transmitting it through a cookie, local storage, or an HTTP header. These options have different security properties and should not be treated as interchangeable.
Protecting an API
An API connects different parts of a system. Access controls help prevent unauthorized users from reaching protected data or functions. The tutorial mentions tokens, CORS (Cross-Origin Resource Sharing), and checking user permissions.
Development setup described in the tutorial
The tutorial’s example environment uses a project, Docker Compose, MySQL, and phpMyAdmin.
Create a project
Set up the project structure and install the libraries needed for the tutorial’s authentication example.
Use Docker Compose
Docker Compose is used in the example to manage development containers for MySQL and phpMyAdmin.
Create a MySQL database
Create the database and tables needed for the example, including a table for user data.
Use phpMyAdmin
The tutorial uses phpMyAdmin to create tables, inspect data, and manage the database.
Password hashing topics
The tutorial introduces hash functions, bcrypt, and salts as concepts related to storing passwords.
Hash functions
The lesson describes a hash function as a one-way transformation that is not intended to be reversed and presents it as suitable for password storage.
Bcrypt
The tutorial demonstrates bcrypt as a password-hashing option. Select and configure password hashing according to current security guidance and your framework.
Salt
A salt is a random value used by a password-hashing process to help protect stored password hashes from precomputed attacks. Use a library that manages this correctly.
Registration and error handling
The registration API accepts new user details such as email and password. The tutorial also covers handling errors so the API can respond to failures appropriately.
Authenticating a user
After storing credentials, the tutorial moves to login verification and handling successful and failed attempts.
Login API and bcrypt comparison
The login endpoint checks the submitted email and password. A bcrypt comparison checks the submitted password against the stored hash rather than comparing plain-text passwords.
Handle failed and successful logins
The application needs to handle both outcomes after checking the credentials.
Identity after login
The tutorial covers JWT, cookies, and local storage as ways to manage identity or session information after login.
What is a JWT?
A JSON Web Token has three main parts: a header, a payload, and a signature.
Creating and using a JWT
The tutorial introduces creating a token and sending it on later requests to identify the user.
Send a JWT in a header
One approach shown is to send a JWT in an HTTP header. Protect tokens and choose storage and transmission patterns based on current security guidance.
Cookies and local storage
A cookie is stored by the browser from server instructions. Local storage keeps data in the browser until it is removed. The tutorial presents both as storage options; implementation should account for their different risks.
Protect API routes
The API topics include retrieving user data, sending a bearer token in an Authorization header, validating the token, and configuring CORS.
User API and bearer tokens
A user-data endpoint should check authorization before returning protected information. A bearer token is one format for presenting a token to a server.
Authorization header and token validation
The Authorization header can carry the token. The server must validate it before granting access.
CORS
CORS is a browser mechanism that controls whether a page can access resources from another origin. It is not a substitute for authentication or authorization.
Front-end flow
The final section covers building a login form, using a password input, sending requests with Axios, storing a token in local storage, and retrieving user information after sign-in.
- Store passwords using a suitable password-hashing approach.
- Authenticate the user and handle login results.
- Manage session or token information with care.
- Protect API routes and user data.
- Understand JWTs, cookies, local storage, and CORS as distinct concepts.
This overview reflects the topics in the tutorial. It is not a security audit, and it does not establish that every implementation choice in the video is safe for a current production system.