The Full Stack Developer Answer That Instantly Builds My Confidence

Q: How does login work in your project?

A: The user enters email and password. We send
it to the backend. The backend checks the database
and if it matches we send a token. The frontend
saves it and shows the dashboard. If not logged in,
the dashboard is hidden.

What I note: no hashing, no idea what the token is,
and 'hidden on the frontend' as security.

Q: How does login work in your project?

A: On signup I hash the password with bcrypt,
cost 12, and store only the hash. On login I find
the user by email and run bcrypt.compare. If either
step fails I return the same 'invalid credentials'
message. If it passes, I sign a JWT with the user id
and a 15-minute expiry and send it as an httpOnly
cookie. Every protected API route goes through an
auth middleware that verifies the token first.

// npm install bcrypt
const bcrypt = require('bcrypt');

router.post('/register', async (req, res, next) => {
  try {
    const { email, password } = req.body;
    if (!email || !password || password.length < 8) {
      return res.status(400).json({ error: 'Email and 8+ char password required' });
    }
    const hash = await bcrypt.hash(password, 12); // salt is generated inside
    const user = await User.create({ email: email.toLowerCase(), passwordHash: hash });
    res.status(201).json({ id: user.id, email: user.email });
  } catch (err) {
    if (err.code === 11000) {               // MongoDB duplicate key
      return res.status(409).json({ error: 'Email already registered' });
    }
    next(err);
  }
});

const jwt = require('jsonwebtoken');

router.post('/login', async (req, res, next) => {
  try {
    const { email, password } = req.body;
    const user = await User.findOne({ email: (email || '').toLowerCase() });
    const ok = user && await bcrypt.compare(password || '', user.passwordHash);
    if (!ok) {
      return res.status(401).json({ error: 'Invalid email or password' });
    }
    const token = jwt.sign({ sub: user.id }, process.env.JWT_SECRET, { expiresIn: '15m' });
    res.cookie('token', token, {
      httpOnly: true,
      secure: true,
      sameSite: 'lax',
      maxAge: 15 * 60 * 1000
    });
    res.json({ id: user.id, email: user.email });
  } catch (err) {
    next(err);
  }
});

// npm install cookie-parser jsonwebtoken
const cookieParser = require('cookie-parser');
app.use(cookieParser());

function requireAuth(req, res, next) {
  const token = req.cookies.token;
  if (!token) return res.status(401).json({ error: 'Not logged in' });
  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET);
    req.user = { id: payload.sub };
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Session expired' });
  }
}

app.get('/api/me', requireAuth, async (req, res) => {
  const user = await User.findById(req.user.id).select('email');
  res.json(user);
});

// The cookie is sent automatically, but only if
// credentials are included on cross-origin requests.
async function loadProfile() {
  const res = await fetch('/api/me', { credentials: 'include' });
  if (res.status === 401) {
    window.location.assign('/login');
    return null;
  }
  if (!res.ok) throw new Error('Could not load profile');
  return res.json();
}

// On the Express side, a different-origin frontend
// also needs CORS configured with credentials: true
// and an exact origin, not '*'.

MY LOGIN ANSWER (under 90 seconds)

1. Storage:
   "On signup I hash with ____, cost ____."

2. Login check:
   "I find the user by ____ and compare with ____.
    On failure I return ____."

3. After login:
   "I issue a ____ containing ____,
    expiring in ____, stored in ____."

4. Protection:
   "Every protected route uses ____ to ____."

5. Trade-off:
   "I chose ____ because ____; the cost is ____."

OPEN YOUR PROJECT AND CONFIRM

[ ] Where is the password hashed? File: ______
[ ] Which library and cost factor? __________
[ ] What does the login error message say? ___
[ ] Where is the token or session stored? ____
[ ] Where is the JWT secret loaded from? _____
[ ] Which routes use the auth middleware? ____
[ ] What happens when the token expires? _____
[ ] Is the secret or .env file in Git? Y / N

Any surprise here? Fix it or prepare to
explain it honestly.

QUESTIONS TO ANSWER ALOUD

- Why not hash passwords with plain SHA-256?
- What is inside your JWT? Can users read it?
- How would you log a user out everywhere?
- Why httpOnly? What does SameSite do?
- What happens if someone steals the token?
- How would you add Google sign-in later?

Note: a JWT payload is only base64url encoded,
not encrypted. Never put secrets in it.