Auth Overview

Typical beginner path: register/login with hashed passwords (bcrypt) and JWTs or cookies. Protect API routes; keep tokens out of localStorage if you can use httpOnly cookies.

• Never store plain-text passwords.
• Use HTTPS in production.
• Authorize: logged-in is not the same as allowed.

After you read this chapter, use Write (when available) and Quiz on this page to lock it in.