Read these instructions carefully. Understand exactly what is expected before starting this Sprint Challenge.
This challenge allows you to practice the concepts and techniques learned over the past sprint and apply them in a concrete project. This sprint explored Authentication and Testing. During this sprint, you studied authentication, JSON web tokens, unit testing, and backend testing. In your challenge this week, you will demonstrate your mastery of these skills by creating a dad jokes app.
This is an individual assessment. All work must be your own. All projects will be submitted to Codegrade for automated review. You will also be given feedback by code reviewers on Monday following the challenge submission. For more information on the review process click here.
You are not allowed to collaborate during the sprint challenge.
- Run
npm install
to install your dependencies. - Run tests locally executing
npm test
.
Dad jokes are all the rage these days! In this challenge, you will build a real wise-guy application.
Users must be able to call the [POST] /api/auth/register
endpoint to create a new account, and the [POST] /api/auth/login
endpoint to get a token.
We also need to make sure nobody without the token can call [GET] /api/jokes
and gain access to our dad jokes.
We will hash the user's password using bcryptjs
, and use JSON Web Tokens and the jsonwebtoken
library.
Your finished project must include all of the following requirements (further instructions are found inside each file):
- An authentication workflow with functionality for account creation and login, implemented inside
api/auth/auth-router.js
. - Middleware used to restrict access to resources from non-authenticated requests, implemented inside
api/middleware/restricted.js
. - A minimum of 2 tests per API endpoint, written inside
api/server.test.js
.
IMPORTANT Notes:
- Do not exceed 2^8 rounds of hashing with
bcryptjs
. - If you use environment variables make sure to provide fallbacks in the code (e.g.
process.env.SECRET || "shh"
). - You are welcome to create additional files but do not move or rename existing files or folders.
- Do not alter your
package.json
file except to install extra libraries. Do not update existing packages. - The database already has the
users
table, but if you run into issues, the migration is available. - In your solution, it is essential that you follow best practices and produce clean and professional results.
- Schedule time to review, refine, and assess your work and perform basic professional polishing.
- Submit via Codegrade by pushing commits to your
main
branch on Github. - Check Codegrade before the deadline to compare its results against your local tests.
- Check Codegrade on the days following the Sprint Challenge for reviewer feedback.
- New commits will be evaluated by Codegrade if pushed before the sprint challenge deadline.
Be prepared to demonstrate your understanding of this week's concepts by answering questions on the following topics.
-
Differences between using sessions or JSON Web Tokens for authentication.
First, authentication is the process by which our web api verifies a client's id that is trying to access a resource. Sessions provide a way to persist data across requests. when using sessions, each client will have a unique session sotred on the server. You can store session data in memory. Data stored in memory is wiped when the server restarts. The preferred way os storing sessions is in memory cache.
JSON web tokens(JWT) are a way to transmit information between parties in a JSON object. This is most commonly used for authentication. JWT is a string that is separted by a period(.) first is the header, then payload, and the signature. JWT scales better than that of sessions because tokens are stored on the client while session makes use of the server's memory.
-
What does
bcryptjs
do to help us store passwords in a secure manner?bcrypt allows us to hash passwords before we save them to the database. bcrypt allows us to hash the password(s) multiple rounds, this means attackers need to have the hash, know the algo used, and how many rounds of hashing it went through.
-
How are unit tests different from integration and end-to-end testing?
Unit testing is checking to see that a unit works correctly in isolation. It checks that individual, isolated parts of the code work correctly.
Integration testing checks how different parts of the application work together. Making sure that different parts of the application work together properly. These are more advanced and challenging to write than unit tests
End-to-end test looks at the entire user experience. It asks if a user can accomplish an action. It also focuses on UI, it mimics how the user interacts with the UI.
-
How does Test Driven Development change the way we write applications and tests?
With Test Driven Development(TDD), we first start by writing the tests before the code. The theory is, you can write much higher quality code when you start with the end in mind.