search

FAC6 / FAC7

5 stars 2 forks source link

Week 9: Authentication & Authorisation (w/c: 7th March) #19

Open Jbarget opened 8 years ago

Jbarget commented 8 years ago

Topics to cover:

Authentication

Authorisation

rub1e commented 8 years ago

I'm sure you'll be doing this anyway, but just to reiterate - please document as much as possible - even stuff that doesn't end up making it into the workshop, please make sure it isn't thrown away. I only mention it because you said on gitter that there's no resource from FAC6 to reuse for this week - so we must make sure there is one for FAC7+

Jbarget commented 8 years ago

sure thing

des-des commented 8 years ago

Cool I think you have everything covered there. What was the project last time / are we doing the same?

Jbarget commented 8 years ago

since there wasnt an auth week for us there is no last project as a template. The only time i really ventured into authentication was on the chatroom project (username/password + jwts), that theyre doing this week.

We have free reign on making a project

des-des commented 8 years ago

Wasnt github auth week?

des-des commented 8 years ago

Defo a week where we tried (and failed because it was too much work) to do oauth and jwts ...

hdrdavies commented 8 years ago

Yeah Auth week was with Jack McDonald and involved the github API

Jbarget commented 8 years ago

in terms of a project what about something like a website for an address book where you log in and update/delete/add contacts with a stretch goal of implementing sending a message to that contact (message bird api or twillio). That way we can say focus on getting your auth scheme solid and worry about the functionality if you get that far

Jbarget commented 8 years ago

create an account as well, with admin users who can edit anyones address book & normal users who can only edit their own

des-des commented 8 years ago

@Jbarget What auth stuff would be involved. Would you login via third party (oauth/simpleauth) or save user+password (bcrypt + database + signup flow)

Jbarget commented 8 years ago

that would be up to them, ideally 2 groups on each method. whats your thoughts?

des-des commented 8 years ago

Yeah that would be awesome. In the case where you do oauth that adds the options of then using the api of whatever you have oauthed with (ie github for us). There is SO much here. I almost feel it should be two weeks: 1. oauth + apis; 2. saving passwords with bcrypt and managing user accounts ... :(

Jbarget commented 8 years ago

in terms of too much is there a part you think we should focus on? Maybe show that in the form of prioritising the bullet points above...

des-des commented 8 years ago

AP: db persistence of sessions optional

des-des commented 8 years ago

project proposal:

Description:

Authentication

This week you are learning about authentication.

Project as follows:

  1. Get some content on your backend (text, image, video, gif / whatever!)
    1. Do oAuth + get content from API
    2. Allow your users to create their own username and passwords and create an account. Do not save unhashed passwords! Generate content however you want!
  2. Serve some of the content you have created/retrieved to unauthenticated users but have some that needs authentication to access.
des-des commented 8 years ago

@sohilpandya. Hey did you guys decide to do authentication this week? Obvs would be cool to update me and @Jbarget on this as we are spending time planning next week as confused about what they are doing it this week.

mantagen commented 8 years ago

@/all this looks pretty sweet as a project. To add to @des-des project proposal (albeit not that substantially), we could suggest which services to do oAuth with - github ? google ?

Also, shall we feed them some good practice guides on some of the above? Good guides aren't cheating etc they're just (hopefully) preventing much much wasted time on poorly written / poorly whatever tutorials

Jbarget commented 8 years ago

@mantagen agree on all fronts,

in terms of oAuth how about we suggest 3 APIs to use from these: Github, Google, Linkedin, Facebook, Twitter

the good practice guides would come from doing a bit of rummaging so if we all have a look and see what we come up with in terms of resources and choose the best ones to pass on?

des-des commented 8 years ago

@mantagen yup agreed. This is more a rough statement of intent and obvs needs fleshing out. @Jbarget :+1:

Jbarget commented 8 years ago

thanks hug1: https://www.youtube.com/watch?v=8ZtInClXe1Q

Jbarget commented 8 years ago

monday workshop based on recreating this plugin: https://github.com/dwyl/hapi-auth-github/tree/master/lib

Jbarget commented 8 years ago

(Provisional) Timetable for Auth Week:

Monday: 10 - 11: oAuth flow diagram (client, server, 3rd party) 9 steps producing access token (Authentication) 11 - 1: Live coding oAuth example 2 - 6: Discussion about how to store access token (cookies, jwt, local/session storage)

Tuesday:

Tutorial Day

Tuesday - Thursday:

Projects

Friday:

10:30 - 12: Code Review 12 - 1: Respond to issues 1 - 2: Lunch/write up stop go continue 2 - 2:45: go through stop go continue 2:45 - 3:15: upstairs project 3:15 - 4: Business Development 4 - 6: Project Presentations

Jbarget commented 8 years ago

Tutorial Day Topics

Authentication

Authorisation

Jbarget commented 8 years ago

Project Schpiel (need to flesh out and give more guidance)

No plugins?

Authentication

This week you are learning about authentication.

Project as follows:

  1. Get some content on your backend (text, image, video, gif / whatever!)
    1. Do oAuth + get content from API
    2. Allow your users to create their own username and passwords and create an account. Do not save unhashed passwords! Generate content however you want!
  2. Serve some of the content you have created/retrieved to unauthenticated users but have some that needs authentication to access.

Stretch goals?

des-des commented 8 years ago

went through github oauth again .. https://github.com/des-des/oauth-example

tormod17 commented 8 years ago

@Jbarget This video (9mins) walk through is good you could possibly show the class this first. Once they've watched it once you can elicit the rest of the stages whilst you walk them through it on the board. https://www.youtube.com/watch?v=rw_zSCbzRRA