aichallengesafrica
Take a challenge
HomeChallengesRepsProblemsLeaderboardTake a challenge

Auth API

JWT with roles, a refresh endpoint, and passwords that are never stored in plain text.

Intermediate25 min on the clock7 graded checks · 100 pointsASP.NET Core Refactor
Graded by reading your code against the checklist below.

What you build

  • Issue a signed JWT containing the user id and their roles
  • Add a refresh endpoint that exchanges a refresh token for a new pair
  • Declare a role-based authorization policy and apply it to an endpoint
  • Hash passwords on the way in and verify on login
  • Return 401 when credentials or refresh tokens do not check out

Done means

POST /auth/login returns 200 with a token pair for good credentials and 401 for bad ones.

How it is graded

Published in full, before you start — every point is one of these and there is nothing else.

  1. Generate a signed JWT with claims+20Authentication and tokens
  2. Add a refresh-token endpoint+20Authentication and tokens
  3. Declare a role-based policy+15Roles and policies
  4. Apply the policy to an endpoint+10Roles and policies
  5. Hash the password, never store it raw+15Authentication and tokens
  6. Verify the hash and return 401 on failure+15Authentication and tokens
  7. Validate the token signature+5Authentication and tokens

What it teaches

The rest of ASP.NET Core Refactor

CRUD + PaginationIntermediate · 20 minAI Streaming EndpointAdvanced · 25 minVertical Slice RefactorIntermediate · 30 minDomain Model Security GuardIntermediate · 20 minVerifying What The Browser ClaimsIntermediate · 25 minPayment Webhook State MachineAdvanced · 45 min