📝 Project
LESSON 28 OF 32
Project 5 — REST API + Auth
Project: Fully Authenticated Backend
Combine Express, MongoDB, and JWT into a real backend: users can register, log in, and manage their own protected resources.
📝 Project 5 Checklist — REST API + Auth
Uses Lessons 25–27: Express CRUD, Mongoose, and JWT.
POST /api/register— hashes password with bcrypt, saves user to MongoDBPOST /api/login— verifies password, returns a signed JWT- A
protectmiddleware that rejects requests without a valid token - Full CRUD routes for one resource (e.g. tasks or notes), all behind
protect - Each resource is linked to the user who created it (store
userIdon the document) - Users can only read/update/delete their own resources, not others'
- Requests without a token return 401 Unauthorized, not a crash
- Passwords are never returned in any API response
- Environment variables (
.env) store the JWT secret and DB connection string
Stretch goal: Add a
PATCH /api/profile route that lets a logged-in user update their own email or password.