Auth & Security
Proving who someone is, then limiting what they can touch.
Authentication asks who you are. Permissions ask what you may touch. A login page with no row-level rules is a front door with no interior locks.
Row-level rules in the database are enforced whether the screen remembers to check or not. That is the real wall — not the login page.
Visual walkthrough
Who gets through the gate
Who is knocking
no session
The notes table
0 of 4 readable
No session, no rows. The gate is the database, not the login page.
Words you will hear
- Session
- The sticker on the back of your badge — it proves you already checked in and expires so a lost badge isn't forever.
- Row-level rule
- A database rule that filters each user to only their own rows, enforced even when the screen forgets.
- Secret
- A key stored on the server that visitors can never read, even by inspecting the page.
Interactive demo
Pick a sign-in method
- Dentist Tuesday 9am
- Pay the gas bill
- Call mum back
- Renew passport
- Gift idea: film camera
- Salary review notes
Row-level rules
The database decides which rows each signed-in person may read.
| id | owner | body | visible to |
|---|---|---|---|
| n_01 | maya | Dentist Tuesday 9am | →Maya only |
| n_02 | sam | Renew passport | →Sam only |
| n_03 | maya | Pay the gas bill | →Maya only |
| n_04 | sam | Gift idea: film camera | →Sam only |
| n_05 | maya | Call mum back | →Maya only |
| n_06 | sam | Salary review notes | →Sam only |
What makes this work
The pieces underneath
Try it
20 minAdd sign-in to a simple notes app so each person sees only their own notes. Then sign in as a second account and confirm the first user's notes are completely invisible.
- Ask explicitly for row-level rules, not just a login page.
- Never store roles or admin flags where a browser can change them.
Free account
Save your progress and earn your certificate
Keep reading as long as you like — everything here stays open. Add your email and we will track your completion, sync it across devices, and issue your Vibe Coding micro-credential when you finish.
Just enter your email. We will send you a link — no password needed.