Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Extend a full-stack app with real AUTHENTICATION and DEPLOY it. Implement a login flow: the client collects credentials, the server verifies against salted-hashed passwords (bcrypt/argon2) and establishes a session or issues a JWT stored in an HttpOnly cookie; protect both frontend routes (UX) and backend endpoints (real enforcement) and add basic authorization. Configure CORS correctly for your domains, validate everything server-side, and DEPLOY all three tiers (frontend, backend, database) to a real host with environment-based config and secrets kept out of the repo/bundle.
Login flow with salted-hashed passwords; sessions/JWT in HttpOnly cookies; BOTH routes and endpoints protected; authz enforced server-side.
CORS configured correctly per environment; consistent request/response shapes; cross-boundary errors handled.
All three tiers deployed and reachable over HTTPS; env-based config; no secrets in the repo or frontend bundle.
Server-side validation everywhere; basic XSS/CSRF/SQLi defenses; dependencies reasonably current.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A full-stack app with auth, deployed ## Goal Extend a full-stack app with real AUTHENTICATION and DEPLOY it. Implement a login flow: the client collects credentials, the server verifies against salted-hashed passwords (bcrypt/argon2) and establishes a session or issues a JWT stored in an HttpOnly cookie; protect both frontend routes (UX) and backend endpoints (real enforcement) and add basic authorization. Configure CORS correctly for your domains, validate everything server-side, and DEPLOY all three tiers (frontend, backend, database) to a real host with environment-based config and secrets kept out of the repo/bundle. ## Acceptance criteria - [ ] Auth across the stack: Login flow with salted-hashed passwords; sessions/JWT in HttpOnly cookies; BOTH routes and endpoints protected; authz enforced server-side. - [ ] Integration: CORS configured correctly per environment; consistent request/response shapes; cross-boundary errors handled. - [ ] Deployment: All three tiers deployed and reachable over HTTPS; env-based config; no secrets in the repo or frontend bundle. - [ ] Security hygiene: Server-side validation everywhere; basic XSS/CSRF/SQLi defenses; dependencies reasonably current. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.