Demo: registration with password hashing and throttling
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
build registration and a safe login. Prepares JNR-037-LAB1.
Draft outline details
Step by step
- Add the encoder bean and a
POST /api/auth/registerendpoint with validation (length, email format). - Hash the password in the service; store only the hash.
- Return the same response whether or not the email already exists (or a generic message).
- Add a simple in-memory throttle: 5 failures per account and IP, then 429 for a period.
- Planned mistake: logging the whole request body, which prints the password. Fix: log only the email and mask or skip bodies.
- Search logs and database for any plaintext password.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.