User Authentication

[nok-ko]

Tasks: (Server-side)

• Hash user passwords.
  • Done using the bcrypt module.
• On login:
  • Accept an email/password pair as query parameters on the /login endpoint…
    • Accept handle + password logins #11
  • Check if a user with this email exists…
    • If user does not exist, send back an error.
  • Check if the password hashes alike to the hash we have stored for that user…
    • If hashes don't match, send back an error.
  • Generate a session token and log the user in if the hashes match.
    • Send back a success message with the token and some user info on successful login.
  • Use exponential timeouts for failing login attempts. (Not allowed to do another one for 1 second, 1 second, 1 second, 10 seconds, 100 seconds…)
  • Also implement other bot/spam prevention measures on this endpoint!
• On signup:
  • Accept K/V pairs of {email:"…", pass:"…", handle:"…"} as query parameters on the /signup endpoint:
    • Validate parameters received by /signup endpoint before writing to DB #10
  • Implement bot/spam prevention measures on this endpoint!

Tasks: (Client-side)

• Keep track of “logged in” state
  • Show a “Log Out” button to logged-in users #12
  • Display logged-in users' usernames
• Display Sign Up / Log In dialog errors inside the dialog itself #13
  • Add more form validation (Research the best way to do this!)

[nok-ko]

Currently good enough, closing for now.