Password hashing, CORS, and secrets
By the end of today you can explain why passwords are hashed rather than encrypted, read a CORS error and know exactly what the browser is telling you, and say where secrets belong.
YesterdayOn Day 39 you issued credentials. Today you protect the things around them.
TomorrowTomorrow you move to where the data actually lives, and start thinking in tables and relationships.
Why this matters
These three cause an enormous share of real incidents and wasted hours. CORS in particular is misunderstood by almost everyone who has fought with it.
- Password hashing
- One-way and deliberately slow, with a salt so identical passwords differ.
- CORS
- A browser protection for users, not a server protection for your API.
- Secrets
- Environment, never source control, and a committed secret is compromised forever.
- Security headers
- A short list of response headers and what each one stops.
Learn it
75 minCopy this into Claude or ChatGPT. It quizzes you before it explains anything, which is deliberate. The resources under it are how you check what it told you.
Today's Master Prompt
Free · sign inA prompt written for this day alone: your level, the exact scope, what to leave out, and an instruction to quiz you before it explains anything. Paste it into Claude or ChatGPT and it teaches you today's material.
Check it against something that is not a model
An assistant can be fluent and wrong, and on a topic you met today you will not catch it. These cover the same ground and were made by people who do this for a living, so they are what you hold the explanation up against. They are other people's work and we only link to them, so judge them for yourself.
3 hand-picked resources
Free · sign inVideos, official docs and articles covering the same ground, each opened and annotated by hand. They are what you check the assistant against on a day you cannot yet catch it being wrong.
Build it
50 minAdd password registration and login to your API using a proper slow hashing algorithm with salting, and confirm two users with the same password get different stored hashes. Then trigger a real CORS error by calling your API from a browser page on another origin, read the console message carefully, and fix it deliberately rather than with a wildcard.
Recall it
20 minAnswer out loud, reveal, then mark honestly whether you had it. That score is the only thing on this page you do not get to choose.
5 recall questions
Free · sign inQuestions you answer from memory, then grade yourself against the real answer. The score is carried into the mastery rating below it, so an honest miss cannot quietly become a tick.
Rate it
Finishing a day and understanding it are two different things, and this page counts them separately.
Mastery tracking
Free · sign inRate yourself against five named criteria per concept. Completion and mastery are tracked separately, and anything you rate shakily comes back automatically on a spaced schedule.
Recap
- 01Hashing is one-way; encryption is reversible and the key is nearby
- 02Password hashes are deliberately slow, because attackers guess in bulk
- 03CORS is a browser protection for users, not a server protection for you
- 04A committed secret is compromised forever; rotate it
Your progress
Free · sign inMark days complete, pick up where you left off across devices, and watch completion and mastery diverge. Free, and the account exists only so ninety days of work cannot vanish with a cleared browser.