This lesson's interactive features are locked, please to keep using them
Authentication
Many attacks on web applications start with a simple question:
Who does the system think I am?
Authentication is the process of verifying who a user is. If your application gets that answer wrong, an attacker can take over another user's account.
Imagine if I could make an HTTP request to the YouTube API and upload a video to your channel... not so good.
Authentication and Authorization
Successful authentication changes a request's security context, but it doesn't make the input trustworthy. Just because you're authenticated on Boot.dev doesn't mean we're going to let you change someone else's username!
The server still needs authorization checks before returning private data or allowing protected actions. That said, an attacker who steals an active session credential can use the victim's permissions. Authentication is a high-value target!
Canonical Identities
A common authentication mistake is letting one account identifier appear in multiple formats without a consistent rule. For example, an app might treat these email addresses as different:
But they all almost certainly point to the same mailbox, because email systems tend to treat addresses as case-insensitive. Apps should choose one canonical representation for any type of ID before storing it or looking it up... and for our purposes, we'll just lowercase the email address and strip whitespace.
Assignment
Bearly Secure currently allows for different formats of email addresses! Our architect has decided that we should trim surrounding whitespace and force lowercase for all account emails.
Lowercasing an email address is a deliberate product rule for this app, not a universal rule regarding email. SMTP technically preserves case in the local part, while domains are case-insensitive. The important security rule is consistency.
With Bearly Secure still running, run and submit the CLI tests from the project root.