Passwords, Sessions and Cookies

MODULE 15 · LESSON 15.1

Store password verifiers safely and use hardened cookies for browser sessions.

Practice-firstBeginner-friendlyProduction-aware

From mental model to working change

Treat Passwords, Sessions and Cookies as an engineering decision with consequences for the user, the next layer and the person debugging it later. This lesson defines an application trust boundary, where an explicit contract is safer than framework convention or an undocumented assumption.

Here, that decision supports a specific checkpoint: Add secure account, login and ownership rules to CourseFlow. A reviewable result should include a repeatable request, automated test, query result and failure response rather than a claim that the feature simply works.

Passwords, Sessions and Cookies workflowA four-step visual showing password hashing, session IDs, Secure cookies, logout and rotation.Passwords, Sessions and Cookies workflow1Password Hashing2Session IDs3Secure Cookies4Logout AndRotation

Passwords, Sessions and Cookies workflow

  1. 1Password Hashing
  2. 2Session IDs
  3. 3Secure Cookies
  4. 4Logout And Rotation
Passwords, Sessions and Cookies workflow: a practical sequence used in this lesson.

A practical model for passwords, sessions and cookies

Store password verifiers safely and use hardened cookies for browser sessions. The useful unit of understanding is the boundary: who owns the decision, which input crosses it, what result is visible and how a failure is reported.

  • Password Hashing: Locate this responsibility in CourseFlow and defend the boundary you chose.
  • Session IDs: Implement one behavior that another learner can reproduce without reading your mind.
  • Secure Cookies: Compare the simplest correct approach with one credible alternative.
  • Logout And Rotation: State the assumption this concept relies on and show how the system behaves when it is false.

Follow the data through the example

Do not copy the sample yet. First explain why password hashing is handled at this boundary and what would break if it moved.

JAVASCRIPT
res.cookie('session', sessionId, {
  httpOnly: true, secure: true, sameSite: 'lax', path: '/'
});
Keep the boundary visible

Point to the exact line or command where session IDs enters the example and where its result becomes observable.

Ship a reviewable increment

  1. 1
    Password Hashing

    Name the caller and the owner of this behavior before changing the implementation.

  2. 2
    Session IDs

    Compare expected and actual output before editing; the difference tells you where to investigate.

  3. 3
    Secure Cookies

    Keep names tied to the product rule so a reviewer can follow the change without decoding abbreviations.

  4. 4
    Logout And Rotation

    Add a regression check close to the boundary where this behavior can fail.

Risks to catch during review

  • Treating password hashing as vocabulary instead of defining the behavior it must produce.
  • Testing the expected path while ignoring an empty, invalid, repeated or unauthorized case around session IDs.
  • Allowing Secure cookies to cross a boundary without an explicit contract or useful error.
  • Changing several layers before capturing the first piece of evidence, which makes the original cause harder to see.

A repeatable investigation sequence

  1. Reduce the problem to the smallest failing Passwords, Sessions and Cookies case.
  2. Capture the actual input and output at the password hashing boundary.
  3. Read the first relevant error, request, trace or query rather than the loudest downstream symptom.
  4. Test one explanation for the failure in session IDs; avoid changing two variables together.
  5. Keep a regression check that would expose the same defect if it returned.

Security decision

Validate external input, authorize the requested action, use parameterized data access, and keep credentials out of responses, source control and logs.

Performance decision

Bound queries and collections, inspect the actual request or query plan, and optimize only the slow boundary confirmed by evidence.

PRACTICE

Build something you can inspect

Implement session creation, renewal and revocation without storing raw passwords or session tokens in logs.

Stretch challenge

Build a second implementation of password hashing, compare it with the first, and defend the choice you would ship.

Definition of done

  • The behavior around password hashing works with realistic input.
  • A failure involving session IDs is handled clearly and without leaking sensitive detail.
  • The implementation remains keyboard-usable when it produces an interface.
  • Your evidence directly supports the claim made in the exercise.
  • The README records the important trade-off without pretending the solution is universal.

Check your reasoning

Why is an HttpOnly cookie safer than localStorage for a browser session token?

Answer by naming the expected password hashing behavior, the layer responsible for it and the evidence that would confirm your explanation.

Where would you investigate the first failure?

Start where session IDs crosses a boundary. Compare the actual input and output there before following downstream symptoms.

What would make this work reviewable?

Show the focused change, repeatable steps, the result of your check and one honest trade-off connected to Secure cookies.

What to carry into the next lesson

  • Store password verifiers safely and use hardened cookies for browser sessions.
  • Keep password hashing visible at the boundary where it can be tested.
  • Use evidence from session IDs before widening the implementation.

References and related reading

Progress is stored only in this browser.

Share this page

Share this page with the people who will use it next.

X Facebook LinkedIn WhatsApp Email

Discussion

No comments yet. Add the first useful question or observation.