Web Auth Explained: From Password Hashing to OAuth and Secure Session Management

A structured bootcamp guide by Dr. Angela covers the core levels of web authentication, starting from basic email-and-password registration to advanced OAuth integration with Google. It emphasizes that passwords must never be stored as plain text, advocating instead for hashing combined with salting using tools like bcrypt to defend against rainbow table attacks. Session management is addressed through Express-session and Passport.js middleware, which handle user login state on the server side. The guide also stresses storing sensitive credentials such as API keys and session secrets in environment variables via dotenv, keeping them out of source code repositories. Finally, it introduces OAuth as a delegated authentication method that lets users sign in via third-party providers like Google without exposing their passwords to the application.