Skip to content

Developing Work Skills · Career & Development

Secure APIs and Student Data

Enforce account ownership in code and in the database, and prove denied actions change nothing.

Level
Intermediate
Estimated study
About 10 hours
Lessons
9 lessons in 3 modules
Format
Online, self-paced
Start your free 7-day trialAlready a student? Open course

Monthly: $0 today with a card, then $34 on day 8 unless you cancel before then. After the trial, 30 days' notice applies. Active on-campus students have academy access included. Check your existing student account before buying another subscription.

About this course

For learners who finished Server Applications with Node.js and SQL foundations. In about 10 hours you will separate sign-in from permission, scope every query to the signed-in owner, reject forged fields, write Supabase row-level security policies and prove with tests that denied requests change nothing.

What you will be able to do

  • Distinguish authentication from authorization and enforce both server-side.
  • Validate requests and keep credentials out of source code and logs.
  • Test that one account cannot read or change another account's private records.

Course outline

Module 1: Accounts and permissions

3 lessons · 3 h 15 min

Use established authentication tools and enforce resource ownership on the server.

  1. Separate authentication from permission1 h
  2. Verify identity with Supabase Auth1 h 15 min
  3. Scope reads and updates to the verified owner1 h

Module 2: Protect application boundaries

3 lessons · 3 h 15 min

Practice input validation, least privilege, secret handling and request limits.

  1. Reject privileged and malformed update fields1 h
  2. Write and test row-level security policies1 h 15 min
  3. Bound requests and return safe failures1 h

Module 3: Test denied requests

3 lessons · 3 h 30 min

Check unauthenticated and unauthorized actions using test accounts and records.

  1. Test anonymous and cross-account reads1 h
  2. Prove forbidden updates leave records unchanged1 h
  3. Review and deliver the private-notes boundary1 h 30 min
Get helpStart 7-day trial