Authentication and authorization form an application-architecture concern: authentication establishes who can sign in, while authorization determines which authenticated users may access resources or perform actions. React applications commonly address this area with tools such as JWT, OAuth2, Auth0, Okta, Passport.js, OpenID, and related services. section 1.4.1
A practical application must make an explicit tenancy and access decision:
- Use multitenancy when users should sign in and work on their own data; this requires basic security and an authorization step. section 9.2.1
- Treat a single shared data set as a deliberate alternative, recognizing that any user could affect everyone else's data. section 9.2.1
- Pair the sign-up and login screen with data-management utilities, client UI changes, and a logout control. section 9.2.1
Goal-tracking application
A multitenant goal-tracking site presents sign-up or login on first arrival, keeps users working with their own data, and adds logout to the main list display. A forgot-password flow remains deferred when no backend exists. section 9.2.1
Figure 9.3 When you arrive at the new goal-tracking website for the first time, you have to log in or sign up. Ideally, we’d include a “forgot password” flow, but because we don't have a backend, we don't need that feature for now.
Inspect the sign-up and login screen used as the entry point for the goal-tracking application. section 9.2.1
