My portfolio.

Goal

This web application lets users manage their todo list. The application consists of 3 servers: a client server, an authorization server and a database server.

Techniques used

The following techniques were used:

the End-user

• uses a browser to use the tool
• registers his/her user credentials at an authorization server
• logs in at the authorization server via a link presented by the client server
• uses a browser to manage his personal todo list
• creates, reads, updates, deletes todos

the Client server

• has a client id and a client secret
• presents a link to the authorization server where the user can authenticate him/herself
• cannot access the user credentials (user id + password)
• gets, after authentication of the user, an authorization code from the authorization server
• converts this authorization code into a temporary (30’) access token which contains the user id, the user email, the name of the issuing authorization server and an expiration time; the client server can extract the user id and the user email by means of the public key of the authorization server
• renders the user interface for displaying, creating, updating and deleting todos
• uses REST api’s exposed by the database server; each REST api request contains an access token which will be used by the database server

the Authorization server

• renders a login and a signup screen to the user
• manages a user database (sqlite)
• verifies user credentials
• verifies credentials of the client server
• generates encrypted authorization codes to the client server
• verifies authorization codes presented by the client server who is requesting an access token in return
• generates temporary access tokens containing the user id, the user email, the name of the issuing authorization server and an expiration time; these tokens are json web tokens (jwt) signed by the private key of the authorization server

the Database server

• manages a todo database (sqlite)
• exposes REST api’s
• uses the public key of the authorization server to decode the access token which is contained in each REST api request
• checks the access token which can result in exceptions of type InvalidTokenError, InvalidSignatureError, InvalidIssuerError and ExpiredSignatureError
• extracts, if the access token is valid, the user id from the access token; this user id is used to retrieve and update the todos of the user in the todos database

Screenshots

A visual impression:

Link to the code.

The code can be found at this link.