All projects
security
A stateless authentication service
Build token-based authentication with registration, login, refresh, and properly enforced route protection.
Why it matters
Nearly every backend role touches auth, and nearly every candidate describes it vaguely. Having implemented refresh and expiry yourself turns a vague answer into a specific one.
What you build
- Registration with correctly hashed credentials
- Login issuing a signed, expiring token
- A refresh flow that does not extend forever
- Route protection proven by tests, not by inspection
If you want more
- Role-based authorisation
- Token revocation on logout
Build it
A modern adaptive hash with a per-user salt. Never a fast hash, never your own.
- Build registration and login
- Write tests that prove an unauthenticated request cannot get through
Material for the whole build
Shows applied security: correct hashing, token lifecycle, and enforcement verified by tests rather than assumed.
Get a plan built around projects like this