Module 01 · Free
Identity & Authentication
Separate four things a product keeps confusing: who someone claims to be, how they prove it, how that proof is carried on every later request, and how they get back in when the proof is lost.
6 lessons · 17 videos · 4h 17m
- 01.01
What a User Actually Is
Name the four separate things a 'user' collapses - identity, credential, session and authorization - and say which of them a database row actually holds.
- 01.02
Passwords, OTP & Magic Links
Choose between password, emailed code and magic link for a given product, and state the attack each one is still open to.
- 01.03
Passkeys & Phishing-Resistant Auth
Explain why a passkey cannot be phished the way a password or an OTP can, and what changes in your data model when you store one.
- 01.04
Sessions, Cookies & Stolen Tokens
Trace what a browser sends on the request AFTER login, and explain why a stolen session cookie defeats MFA and passkeys alike.
- 01.05
OAuth & OpenID Connect
Say what OAuth delegates and what OIDC adds on top of it, and name the flow RFC 9700 tells you to use and the two it tells you to stop using.
- 01.06
Verification & Account Recovery
Design a password reset and account recovery path that does not become the weakest way into the account.