Files
What you'll learn
- Place every layer from the course in the request pipeline and say what each one answers, and before which other
- Wire helmet, CORS, the throttler, the authentication and roles guards, and hashed passwords into one service from memory of the lessons
- Read a response and tell which layer produced it: the headers, a 429, a 401, a 403
- List what a real deployment still needs that the browser cannot show: secrets from configuration, TLS, a proxy's addresses, shared rate-limit storage
Press Run tests to start the app. Its log appears here.Graded endpoints
Public, never counted, and still wearing helmet's headers: middleware runs before any guard
Headers from helmet, permission from CORS, a count from the throttler, and the public route's body
Answered, with no permission for the page to read it
The browser's question before a POST with a token, answered from CORS alone
Stored as a bcrypt hash, or the store refuses; a user, not an admin
The admin's token; the login route allows two attempts a minute
The second attempt from this address
The throttler answers before the password is even looked at
Roles in the token, read by the guard
A 401 from the authentication guard, still with helmet's headers
Past the throttler and the authentication guard, stopped by the roles guard
Every layer agrees
Any signed-in member of staff; stored encrypted
Decrypted for staff
Public; the ciphertext gives nothing away
Admin only
The admin may; a 204 with helmet's headers and a count
Empty; the second request on this route from this address