Git Product home page Git Product logo

web-auth's Introduction

Take ownership of your application's authentication and authorization

In this workshop, we'll learn how to implement authentication and authorization in a Full Stack Web Application. You'll learn the foundational technologies at play and built upon it to include complicated user auth flows and more.


Build Status GPL 3.0 License Code of Conduct

Prerequisites

Pre-workshop Resources

Here are some resources you can read before taking the workshop to get you up to speed on some of the tools and concepts we'll be covering:

System Requirements

  • git v2.18 or greater
  • NodeJS v18 or greater
  • npm v8 or greater

All of these must be available in your PATH. To verify things are set up properly, you can run this:

git --version
node --version
npm --version

If you have trouble with any of these, learn more about the PATH environment variable and how to fix it here for windows or mac/linux.

Setup

This is a pretty large project (it's actually many apps in one) so it can take several minutes to get everything set up the first time. Please have a strong network connection before running the setup and grab a snack.

Warning

This repo is very large. Make sure you have a good internet connection before you start the setup process. The instructions below use --depth to limit the amount you download, but if you have a slow connection, or you pay for bandwidth, you may want to find a place with a better connection.

Follow these steps to get this set up:

git clone --depth 1 https://github.com/epicweb-dev/web-auth.git
cd web-auth
npm run setup

If you experience errors here, please open an issue with as many details as you can offer.

Exercises

You'll find all the exercises in the exercises directory. The structure of the workshop apps is described below, but most of the time you should be able to simply run the app and navigate around the different exercises using the application (there are even buttons to open the right exercise file right in your editor).

The purpose of the exercise is not for you to work through all the material. It's intended to get your brain thinking about the right questions to ask me as I walk through the material.

Running the app

To get the app up and running (and really see if it worked), run:

npm start

Now open your browser to the address that's logged out for you and you're good to get started!

Running the tests

The test script in the package.json runs the tests on the solutions (these should all pass). To run the tests against your own work, you simply open the problem page and click the "Test" tab.

Launching your editor

The application has several buttons which will launch your editor to the right file. There are a lot of files in this workshop so you'll be using this feature a lot to get to the right place at the right time.

This should just workℒ️, but if it doesn't it could be that our editor guessing isn't working for you. If that's the case, create a .env file in the root of this project and add an environment variable called KCDSHOP_EDITOR with the value being set to the path to your editor's executable. For example, if you're using VS Code on Windows, you'd add this to your .env file:

KCDSHOP_EDITOR="C:\Program Files\Microsoft VS Code\bin\code.cmd"

Make certain that if the path includes spaces that you wrap the path in quotes as above.

Exercises

  • exercises/*.*/README.md: Exercise background information
  • exercises/*.*/*.problem.*/README.*.md: Problem Instructions
  • exercises/*.*/*.problem.*/*.tsx: Exercise with Emoji helpers πŸ‘ˆ You spend most of your time here.
  • exercises/*.*/*.solution.*/*.tsx: Solved version

The purpose of the exercise is not for you to work through all the material. It's intended to get your brain thinking about the right questions to ask me as I walk through the material.

Helpful Emoji 🐨 🦺 πŸ’° πŸ“ πŸ¦‰ πŸ“œ πŸ’£ πŸ’ͺ 🏁 πŸ‘¨β€πŸ’Ό 🚨 πŸ§β€β™€οΈ

Each exercise has comments in it to help you get through the exercise. These fun emoji characters are here to help you.

  • Kody the Koala 🐨 will tell you when there's something specific you should do
  • Lily the Life Jacket 🦺 will help you with any TypeScript-specific parts of the exercises
  • Marty the Money Bag πŸ’° will give you specific tips (and sometimes code) along the way
  • Nancy the Notepad πŸ“ will encourage you to take notes on what you're learning
  • Olivia the Owl πŸ¦‰ will give you useful tidbits/best practice notes
  • Dominic the Document πŸ“œ will give you links to useful documentation
  • Barry the Bomb πŸ’£ will be hanging around anywhere you need to blow stuff up (delete code)
  • Matthew the Muscle πŸ’ͺ will indicate that you're working with an exercise
  • Chuck the Checkered Flag 🏁 will indicate that you're working with a final
  • Peter the Product Manager πŸ‘¨β€πŸ’Ό helps us know what our users want
  • Alfred the Alert 🚨 will occasionally show up in the test failures with potential explanations for why the tests are failing
  • Kellie the Co-worker πŸ§β€β™€οΈ your co-worker who sometimes does work ahead of your exercises

Workshop Feedback

Each exercise has an Elaboration and Feedback link. Please fill that out after the exercise and instruction.

At the end of the workshop, please go here to give overall feedback.

web-auth's People

Contributors

alejandrorpascual avatar bakate avatar ccharlieffox avatar chambersaj avatar dev-xo avatar dg1234uk avatar francisfuzz avatar gregm1991 avatar gregorgabric avatar harrygreen avatar helpme-pls avatar insidiae avatar jstafman avatar justin48 avatar kentcdodds avatar kewinzaq1 avatar mickykebe avatar nartc avatar realjokele avatar ryota-murakami avatar sjmiddlebrook avatar thebat93 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

web-auth's Issues

[Bug] routes for problem set 15 are bugged

Hi there, thanks for this workshop, i've been enjoying my time with it so far.

I would like to raise an issue about bugged routes for problem set 15 (Verify 2fa code).
I am able to navigate to /15/01/problem and am able to set the playground with the playground button.

However, upon closer inspection after setting the playground, the code for the playground app is actually the app of /14/01/problem instead.

Furthermore, if you try to navigate to the next page /15/01/solution via the UI, it instead navigates you to 14/01/solution.

Screen.Recording.2024-03-30.at.10.23.06.mov

realised that under playground tab, there isnt any workshop 15, it just skips from 14 to 16:

Screenshot 2024-03-30 at 10 40 31

"Session Storage" intro description is the same as "Cookie Sessions"

It looks like a new module was added that introduces session cookie interaction with toast notifications, but the overall description for the module is the same as the "Cookie Sessions" one (which I believe had some of this content previously)

It starts with this text:

Storing user preferences is cookies is simple enough. If you check the developer tools for those, you'll often find the value as-is and can modify it using the developer tools (and sometimes even with JavaScript). For user preferences that's fine, but when it comes to authentication, we need to be more careful. Specifically, we need two things:

Inconsistency between username used for existence check and username at creation

When checking if an existing user is in the database, it seems like the raw submitted username is used:

const existingUser = await prisma.user.findUnique({
where: { username: data.username },
select: { id: true },
})

On the other hand, upon actually persisting the user, it seems like a transformed (lowercase) version of the same username is used:

const user = await prisma.user.create({
select: { id: true },
data: {
email: email.toLowerCase(),
username: username.toLowerCase(),
name,
password: {
create: {
hash: await bcrypt.hash(password, 10),
},
},
},
})

If that is indeed the case, it would, at worst, allow clobbering an existing user (ie: account take-over) and at best, produce a unique index collision error instead of the intended .addIssue() trick. I'm not familiar with Prisma so not really sure where this would land.

Toast notifications only work once when deleting notes

When completing the Flash Storage lesson (problem) of the Session Storage module, I noticed when running the app that after you try deleting a note for the 2nd time (without doing a manual page reload), the toast notifications no longer work.

At the very end of the solution step, in the description, you created a utility for managing toast notifications (redirectWithToast), which appears to fix the above issue. It would be great if it could be explained, in the solution step, what the fix was to get that working correctly.

Or perhaps update the problem exercise to have toast notifications working as expected without the utility? Whichever way you think works best for those learning :)

Thanks allot and keep up the great work. πŸ‘πŸΌ

I think it's possible to enforce that a password is required on the User model without leaking it.

In exercise 4 you wrote:

Unfortunately, it's not possible to enforce that a password is required on the User model at the database level. However, it's worth the tradeoff to avoid the risk of leaking passwords.

I was checking the Prisma docs for one-to-one relationships, and found that if you change the relationship scalar (or foreign key) you can make the password field required when creating a User

from Prisma docs (Required and optional 1-1 relation fields)

model User {
  id      Int      @id @default(autoincrement())
  profile Profile? // No relation scalar - must be optional
}

However, you can choose if the side of the relation with a relation scalar should be optional or mandatory. In the following example, profile and profileId are mandatory. This means that you cannot create a User without connecting or creating a Profile:

model User {
  id        Int     @id @default(autoincrement())
  profile   Profile @relation(fields: [profileId], references: [id]) // references `id` of `Profile`
  profileId Int     @unique // relation scalar field (used in the `@relation` attribute above)
}

model Profile {
  id   Int   @id @default(autoincrement())
  user User?
}

so, if you do something like this:

model Password {
  id   String @id @default(cuid())
  hash String
  // πŸ‘‡ Now this is optional
  user User?
}


model User {
  id       String  @id @default(cuid())
  email    String  @unique
  username String  @unique
  name     String?

  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  image      UserImage?
  // πŸ‘‡ note the fields here.
  password   Password   @relation(fields: [passwordId], references: [id])
  passwordId String     @unique

  notes Note[]
}

The password would be required for User creation, and I think it won't eagerly load the relationship field (password on the User model in this case) because Prisma doesn't load those by default.

Error Loading Lessons in Playground

I experienced a few errors in the app when loading a lesson from Mock GitHub OAuth into the playground.

Stack Error

[exercises__sep__17.oauth__sep__02.problem.flow:6162] 
[playground:4000] GET / 200 - - 53.276 ms
[playground:4000] 
[playground:4000] 9:58:50 AM [tsx] restarting
[playground:4000] 
[playground:4000] Debugger listening on ws://127.0.0.1:9229/129abb8c-b96e-4c13-896e-3248d9eab2ac
[playground:4000] For help, see: https://nodejs.org/en/docs/inspector
[playground:4000] 
[playground:4000]  info  rebuilding... (~ app/routes/_auth+/login.tsx)
[playground:4000]  info  rebuilding... (~ app/routes/_auth+/auth.github.ts)
[playground:4000]  info  rebuilding... (~ app/routes/_auth+/auth.github.callback.ts)
[playground:4000] 
[playground:4000] πŸ”Ά Mock server installed
[playground:4000]  info  rebuilt (834ms)
[playground:4000] 
[playground:4000] Error: Cannot find module '/Users/Panzermensch/Desktop/Projects/web-auth/playground/build/index.js' imported from /Users/Panzermensch/Desktop/Projects/web-auth/playground/server/index.ts
[playground:4000] Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/Users/Panzermensch/Desktop/Projects/web-auth/playground/build/index.js' imported from /Users/Panzermensch/Desktop/Projects/web-auth/playground/server/index.ts
[playground:4000]     at __node_internal_captureLargerStackTrace (node:internal/errors:496:5)
[playground:4000]     at new NodeError (node:internal/errors:405:5)
[playground:4000]     at finalizeResolution (node:internal/modules/esm/resolve:226:11)
[playground:4000]     at moduleResolve (node:internal/modules/esm/resolve:838:10)
[playground:4000]     at defaultResolve (node:internal/modules/esm/resolve:1036:11)
[playground:4000]     at nextResolve (node:internal/modules/esm/hooks:733:28)
[playground:4000]     at E (file:///Users/Panzermensch/Desktop/Projects/web-auth/node_modules/tsx/dist/loaders-deprecated-261ba186.mjs:12:49)
[playground:4000]     at D (file:///Users/Panzermensch/Desktop/Projects/web-auth/node_modules/tsx/dist/loaders-deprecated-261ba186.mjs:12:1279)
[playground:4000]     at async nextResolve (node:internal/modules/esm/hooks:733:22)
[playground:4000]     at async Hooks.resolve (node:internal/modules/esm/hooks:242:24)
[playground:4000]     at async MessagePort.handleMessage (node:internal/modules/esm/worker:168:18)
[playground:4000

Error running this project

for some reason when using the basic setup to start this course im getting this error:

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/Users/yonatanitzhaky/Documents/development/epic-web-dev/web-auth/node_modules/@mux/playback-core/dist/index.mjs' imported from /Users/yonatanitzhaky/Documents/development/epic-web-dev/web-auth/node_modules/@mux/mux-player-react/dist/index.mjs
Did you mean to import @mux/playback-core/dist/index.cjs.js?
    at finalizeResolution (node:internal/modules/esm/resolve:264:11)
    at moduleResolve (node:internal/modules/esm/resolve:917:10)
    at defaultResolve (node:internal/modules/esm/resolve:1130:11)
    at ModuleLoader.defaultResolve (node:internal/modules/esm/loader:396:12)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:365:25)
    at ModuleLoader.getModuleJob (node:internal/modules/esm/loader:240:38)
    at ModuleWrap.<anonymous> (node:internal/modules/esm/module_job:85:39)
    at link (node:internal/modules/esm/module_job:84:36) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///Users/yonatanitzhaky/Documents/development/epic-web-dev/web-auth/node_modules/@mux/playback-core/dist/index.mjs'
}

i just did those steps:

git clone --depth 1 https://github.com/epicweb-dev/web-auth.git
cd web-auth
npm run setup

Also the deployed version seems to be dead

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    πŸ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. πŸ“ŠπŸ“ˆπŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❀️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.