Overview
In Part 4, we connected forms to server operations and kept the user’s input when a change was rejected. We will now add accounts and permissions to those interactions. A valid note title does not tell us who sent it or whether that account may edit the note. We will follow a sign-in through later requests, check which changes are permitted, and examine what a denied request leaves unchanged. We will also choose public response fields and handle untrusted text.
The notes workflow provides a familiar example throughout the part. Helpdesk,
profile, document and preferences examples let us apply the same ideas to other
relationships and operations. The chapter snippets explain individual checks;
programming cards supply their own starter files and dependencies. Continue the
marketplace project in marketplace/, applying these ideas to the seller
and buyer interactions from Part 4.
You need the HTTP, TypeScript and validation concepts from Parts 3-4. Review API contracts and validation or client API modules as needed.
Part structure
- Authentication & Passwords — Verify credentials and use the resulting account identity without exposing passwords.
- Sessions & Cookies — Follow the account through reload, expiry and logout, keeping browser state separate from the server session.
- Authorization: Ownership, Relationships & Roles — Check ownership and other resource relationships inside server operations, and relate these rules to RBAC.
- Untrusted Data — Injection & XSS — Select public response fields and keep untrusted values from becoming SQL syntax or page markup.
- Request Protection — Protect cookie-authenticated changes with origin and token checks, and distinguish these checks from abuse controls.
- Authentication Libraries & SSO: Optional Background — Compare local and provider-based sign-in.
- Testing Security Rules — Compare permitted and denied requests, checking the response and stored state.
- Marketplace Project: Secure the Marketplace — Connect supplied authentication to account controls, seller ownership and buyer permissions.
- Recap and Feedback — Reflect on the request checks and give feedback on the part.