Eleven short sessions that build one secure User Management API in Go — from a hashed password to a hardened, rate-limited production backend.
01 · The System
Each session adds one layer to the same request path. By session 11 all of them run, in this order.
net/http, Go 1.22 route patterns, crypto/subtle.02 · The 11 Sessions
AuthN vs AuthZ · bcrypt and its cost · constant-time comparison.
Header · payload · signature · standard claims · why base64 is not encryption.
Signing access tokens · auth middleware · claims in context.
Access + refresh · HttpOnly cookies vs Bearer · rotation and Redis revocation.
Roles and permission maps · role-enforcement middleware.
Claims vs URL ids · owner-or-admin guard.
ABAC attributes · explicit permission checks.
Validation · body limits · token-bucket rate limiting.
CORS preflight · security headers · HSTS and secure cookies.
Env config · hiding sensitive fields · least privilege · BOLA/BFLA.
Every layer, wired together into one production-ready backend.
Start with the one thing every login depends on: never storing the password.