Work & Development · Backend & Full Stack Development

Secure APIs and Student Data

Keep each account's notes private in both the server code and the database.

Level: Intermediate
Lessons: 9 lessons in 3 modules
Estimated study: About 10 hours
Format: Online, self-paced

Start your free 3-day trial Read lesson 1 free Already a student? Open course

Monthly: $0 today with a card, then $34 on day 4 unless you cancel before then. After the trial, 30 days' notice applies. Active on-campus students have academy access included. Check your existing student account before buying another subscription.

Before you start

Recommended preparation:

Use a computer with a keyboard and a current browser. Individual lessons explain the tools needed for each exercise.

Full study requires active Academy access. This course can be audited independently of optional assessed programs.

About this course

After the Node.js and SQL courses, learn to keep each account's notes private. In about 10 hours, verify who is signed in, allow only the owner to use a note, reject forged fields and test that blocked requests leave the data unchanged. Add matching database rules with Supabase.

What you will be able to do

Distinguish authentication from authorization and enforce both server-side.
Validate requests and keep credentials out of source code and logs.
Test that one account cannot read or change another account's private records.

Course outline

Check who is signed in, then separately check which notes that account may use.

Separate authentication from permission1 hFree preview
Verify identity with Supabase Auth1 h 15 min
Scope reads and updates to the verified owner1 h

Accept only permitted fields, limit requests and give each part of the app only the access it needs.

Reject privileged and malformed update fields1 h
Write and test row-level security policies1 h 15 min
Bound requests and return safe failures1 h

Use two test accounts to prove that blocked reads reveal nothing and blocked writes change nothing.

Test anonymous and cross-account reads1 h
Prove forbidden updates leave records unchanged1 h
Review and deliver the private-notes boundary1 h 30 min

Related assessed programs

This course belongs to the following optional programs. Each has its own required course bundle, evidence review and separate fee. Each program page shows its approved fee and current registration status.