Welcome to lesson eight! This lesson focuses on authorization, and how to use OAuth to effectively authenticate users.
Resources for this lesson are accessible to you in this repository
The remainder of the reading for this lesson is just for your information. You are not required to use JWTs at all in this course, but it is important for you to be at least somewhat familiar with what they are and why they exist. In fact, many OAuth providers use JWTs behind the scenes to make their services work. With that said, JWTs are a large focus point in CSE340. The following resources are here to simply introduce you to these concepts, and also to help you see how JWTs and OAuth can be used together.
For the sake of authentication purposes, your API does not need to use both OAuth and JWTs. For your project, you will include both just to understand how both work. With that said, there are some use cases for using both in the real world.
Purpose: Research, learn, and share industry standards, best practices, and helpful resources.
Task: Complete the assignment.
The team activity for this lesson will consist of participating in a developer forum. Each person in this class will learn from different resources, try different things, and end up with a unique knowledge base. This forum is an opportunity for you to share industry standards and best practices regarding the technologies that we are using and that you're learning about in this lesson. To receive full credit for this assignment, you must do the following:
Developer Forum for this assignment.L03 - POST requests in Node.js)Purpose: Implement an authentication system.
Task: Complete the assignment.
By the end of this assignment the student will be able to do the following:
For your personal assignment you will complete your project that you started in lesson 5. You should already have all of your routes set up with documentation, validation, error handling, and so on. Now, you will also add security either through JWTs or some from of OAuth.
| Criteria | Weight | Mastery | Proficient | Developing | Beginning | Missing/Incomplete |
|---|---|---|---|---|---|---|
| 100% | 90% | 78% | 65% | 0% | ||
Deployed to the Web(Graded via YouTube) | 20% | Meets Proficient criteria and video shows use of Render CONFIG VARS to connect to MongoDB | Meets Developing criteria and app connects to MongoDB | Meets Beginning criteria and Render url can be opened without any errors | Node.js app deployed to Render | Render link or YouTube link not submitted |
OAuth(Graded via YouTube) | 20% | Meets Proficient criteria and the video shows that each protected route (needs authentication) requires authentication before access | Meets Developing criteria and user can log out using OAuth | Meets Beginning criteria and user can log in using OAuth | Evidence of OAuth is in the Node.js project | GitHub link or YouTube link not submitted, or No evidence of OAuth in project |
Database(Graded via YouTube) | 15% | Meets Proficient criteria and at least one collection features documents with at least 7 fields | Meets Developing criteria and database has at least 2 collections | Meets Beginning criteria and database has a single collection | Database exists and is shown in the video | GitHub link or YouTube link not submitted, or No evidence of Database in project |
HTTP Requests(Graded via YouTube) | 15% | Meets Proficient criteria plus at least 2 collections have a PUT or DELETE request (MongoDB change is shown in video) | Meets Developing criteria plus at least 2 collections have a POST request (MongoDB change is shown in video) | Meets Beginning criteria plus at least one HTTP Request is present for each collection in the database | Several HTTP Requests are in the project and work (shown in video) | GitHub link, Render link or YouTube link not submitted |
API Documentation(Graded via Render) | 10% | Meets Proficient criteria and the documentation can test each endpoint (GET, POST, PUT, DELETE are all modified when testing from the documentation) | Meets Developing criteria and the documentation is published (either to Render at "/api-docs" route, or to apollo server) | Meets Beginning criteria and documentation is organized by collection | The swagger.json file is present (or Apollo server is shown in video for graphql extra credit) | Render link, GitHub link, or YouTube link not submitted. Or no evidence of API documentation |
Data Validation(Graded via GitHub) | 10% | Meets Proficient criteria and each route has data validation, and returns some type of 400 or 500 error if data requirements aren't met | Meets Developing criteria and data validation is being used for each PUT and DELETE route | Meets Beginning criteria and data validation is being used for each GET and POST route | Node project has evidence of data validation (for example: checks for at least one variable's existence before continuing) | GitHub link or Render link not submitted |
Error Handling(Graded via GitHub) | 10% | Meets Proficient criteria and each route has error handling, and returns some type of 400 or 500 status when errors get thrown | Meets Developing criteria and error handling is being used for each PUT and DELETE route | Meets Beginning criteria and error handling is being used for each GET and POST route | Node project has evidence of error handling (for example: at least one try/catch) | GitHub link or Render link not submitted |
| 20% | Meets Proficient criteria and REST is not used at all, only GraphQL (should be shown in YouTube video) | Meets Developing criteria and project uses GraphQL to access and modify MongoDB (should be shown in YouTube video) | Meets Beginning criteria and project uses GraphQL for some aspects (should be shown in YouTube video) | GitHub link (perhaps in previous commits) and YouTube video show that GraphQL was attempted | GitHub link, Render link, or YouTube link not submitted |
| 20% | Meets Proficient criteria and there is not a single file in project with ".js" extension. All JavaScript files have been replaced with error-free TypeScript (.ts) files | Meets Developing criteria and project uses TypeScript for all files in "controllers" folder | Meets Beginning criteria and project uses TypeScript for some aspects (should be shown in YouTube video and evident in GitHub repository) | GitHub link (perhaps in previous commits) and YouTube video show that TypeScript was attempted | GitHub link, Render link, or YouTube link not submitted |