Why is there a need for another framework? the current approach is not producing fast sites, and this problem will not disappear by waiting for a faster CPU.

Foreword

Qwik in Action

Introduction to the frontend development. Now, the responsibility of creating good or bad applications depends on you because the means available are all there.

Introduction

Overview of TypeScript. TypeScript introduced types into an untyped language like Javascript to ensure code consistency.

TypeScript

Overview of the frontend architectures. In this lesson you will understand the difference from Client Side Rendering and Multi Page Application.

Frontend architectures

Overview of the hydration. In this lesson you will understand the difference from Hydration and Island architecture/Partial Hydration.

Hydration

React Server Component. In this lesson you will understand the difference from Server Component and Client Component.

React Server Component

Qwik resumability will change the frontend ecosystem, In this lesson you will understand why is so great.

Resumability, the Qwik way

Wrap up of frontend architectures module.

Summary Chapter 2

In this lesson you will be able to understand more about performance and you will understand how improve your application with less JavaScript.

Qwik, the framework built on top of closure-extraction

Resumability is the core concept behind Qwik. In this lesson you will understand better the process.

Resumability

Code Extraction is a topic hard to master, you will understand how it works with different approaches.

Code Extraction

JSX syntax is the most famous one because of React, but what about the other frameworks, Vue, Angular?

Why Qwik use JSX syntax

Summary Chapter 3

Let's see together the fundamentals of Qwik. In this lesson you will compare Webpack and Vite.

Getting started with Qwik

The Qwik build process is so important because the resumability process requires correct and intelligent bundling.

Qwik compilation Process

Qwik CLI and amazing tool to have a great Developer Experience with Qwik.

Technical requirements to start a new Qwik application

Qwik Middleware an easy and clever way to expose your RESTful APIs or GraphQL APIs.

Middleware

Wrap up of Getting Started with Qwik module.

Summary Chapter 4

In this lesson you will learn the pillars of SEO. You will lean few new terms and metrics that can help you to measure your application.

In this lesson you will learn the some new things about SEO and crawler.

Sitemap and robots files

Partytown an amazing library to execute third scripts in the service worker.

Partytown

Core Web Vitals are so important for own application. You will learn in detail all the metrics.

Core Web Vitals

Core Web Vitals Labs Data vs Field Data. These two information are so different, let's figure out the peculiarity of those.

Labs data vs Field data

Summary Chapter 5

SEO and Core Web Vitals

There are many ways to deploy a Qwik application. You can have your own server and deploy your Qwik application easily with the Qwik CLI and integrations.

Deploy Qwik in production

Cloud solution are a good alternative for a low cost pipeline and host. Nowadays these kind of services are so smart and great, you should try them.

Cloud solutions

With different team and many developers, it's important to master branching strategies to avoid problems during your day by day.

Branching strategies

Progressive Web App approach can be an alternative to the stores. You can publish you application with a lot of benefit with PWA.

Progressive Web App

Wrap up of Deploy Qwik in Production module.

Summary Chapter 6

Style an application is so important let's see how engage your Stakeholders into this process.

Style and render data with Qwik

CSS is so huge, there are a lot of ways to style your application with Qwik, let's see them together.

CSS and Built-In Styling Methods

Tailwind is an amazing library, let's see together how master it. I will share you some tips and tricks to use Tailwind in a better way.

Tailwind CSS

In this lesson you will learn how manage data with Qwik. There are a lot of APIs to explore, let's jump into the code.

Managing data with Qwik

Summary Chapter 7

In this lesson you will learn how architect a modern frontend end application.

Creating an e-commerce with Qwik and Supabase

In this lesson you will learn the trade offs of technical decisions. I share with you some tips and tricks.

Technological spike

In this lesson you will explore Supabase. This is an amazing service to leverage your business.

Supabase for your backend

A custom authentication is too complex and risky to implement from scratch. Let's use the Supabase auth to optimize our goals.

Let's talk about the Authentication process

Summary Chapter 8

Supabase CLI an handy tool to improve consistency across environments.

Supabase CLI

Let's use the Supabase CLI to manage our database migrations and schemas.

Supabase db migrations

In this lesson you will create the e-commerce homepage with the Supabase client to read the data.

Show products on our homepage

Every e-commerce has a detail page, let's create our product detail page with Qwik.

Product Detail

Cache is really useful and in this lesson I will explain in the detail how it works. I will share my experience in this topic with some cool analogies.

Cache-control headers

Summary Chapter 9

Rendering products with Orama full text search

Let's improve out application with a useful "Add to favorites" feature.

Add a product to your favorites list

In this lesson you will learn how to use Stripe to manage your payments in a secure way.

Adding cart and checkout process with Stripe

Let's try the Supabase database function. This is an easy way to allows us to do several things and also add some logic to our procedure.

Page views tracking

A real-time database with Supabase is so simple to implement, let's build together a new functionality with this great feature.

Real-time database

Summary Chapter 10

Let's explore together the benefit of testing. In this lesson you will explore the various types of tests, Unit Test, E2E, Visual regression tests and more.

Overview of application testing

Let's discuss together how and when testing is valuable for our business. 3X Explore/Expand/Extract can help us is this reasoning.

How much testing is enough? When do I write tests?

In this lesson you will lean the Test driven development TDD flow. It's a really good practice to put in place.

Test-Driven Development (TDD)

In this lesson you will lean how test your components with Cypress.

Let's add some tests with Cypress

Do you need a Qwik component library? Qwik UI is the project for you because can give you a lot of Qwik accessible components out of the box.

Qwik UI

Summary Chapter 11

Adding tests to our Qwik application

Let's explore a bit of history of Qwik. A new framework with a great past.

Final thoughts

Qwik and React together, no problem, qwikify$ is the API to solve your problems.

qwikify$

Qwik and Astro together, no problem, @qwikdev/astro is the library to solve your problems.

Qwik inside Astro application

Qwik and micro-frontends together, no problem, out of the box Qwik can manage this scenario with no external dependencies.

Micro-frontends with Qwik

Summary chapter 12

Enter your name and email address below, then click the **"Send my free chapter"** button to get started

250+ page PDF

EPub

newline Access with Replits

All Code Samples

Discord Community Access

One-time price of $69

( the primaryDescriptionMarkdown is long - several lines, include images, as long as you want )

In this course we <headline of what we do>. <why this technology is good> but <here's how learning it is problem>. 

In <the length of these lessons> we cover <three salient points about what we cover. Your BEST points>. Its <however long it is> and comes with <these bonus features, and reasons to buy. code, etc.>

It's taught by <author name> who <credibility, reason you should listen to them>. <social proof, if you have it yet>

<then you can list other supporting stuff you want to add, anything you want here>

-------
Example:
-------

We created a free course to create your first GraphQL server (from scratch) using Node and TypeScript. TypeScript and GraphQL are a powerful combo, but there's a lot of confusing edges if you're getting it setup the first time.

In this course we cover the basics of getting TypeScript setup with Node, how GraphQL works, and how to set up a GraphQL server using Apollo server. It's two hours long, it comes with complete code examples, and we walk through the code step-by-step.

It's taught by my friend, Shopify-engineer Hassan Djirdeh and he's integrated what he's learned using GraphQL in production as an engineer at Shopify. We've already had over 1,300 students enroll and it's been getting great reviews so far.

// ... and so on

Harness Qwik Resumable Architecture for Lightning-Fast Startup Times

In this course we <headline of what we do>. <why this technology is good> but <here's how learning it is problem>. 

( the summary is short - one or two lines )

Complete Guide to Qwik

Authentication is a fundamental part of every highly dynamic and personalized web application. Authentication refers to the process that identifies a specific user, allowing you to read, write, update, or delete any protected content, depending on your level of authorization. A typical example is a social network, where each user can create personal posts only after authentication, and fortunately, it's not possible to create content on behalf of third parties. This allows for personalizing the experience of using the application for each user and enables you to save configurations and link them to your user profile. Imagine having to save your preference for a dark or light theme; managing authentication makes this possible.

The Authentication Process is Not as Simple as It Seems

The first thing to ask yourself is whether it makes sense to use an external service for authentication or if you should have full control over the process and manage the entire flow with your service. The custom approach has some complexities that are worth considering. First, you have to think about how to safely save your data to prevent external attacks from reading this valuable information. Then, you have to consider the entire flow in its entirety. It's not just about a simple login; there are other features, such as password recovery and many more.

Imagine that initially, your application allows you to log in with an email and password, but subsequently, you're asked to allow authentication via Google. With a custom solution, you would have to invest some effort to cover this functionality. What if you were then asked to log in to Facebook, too? This would be additional unplanned work at the start of the estimates. The possibility of logging in with different providers is the basis of external services, not to mention the sending of emails and notifications that are necessary for a flow of this type. Do you want to reinvent the wheel and create your own service for sending and translating messages? These problems make it clear why the use of an external service now seems like a solution to at least be carefully considered. In fact, for your e-commerce with Qwik, Supabase Auth will be used.

In the past, web-side authentication was based on the concept of server-side sessions. The process began by filling out a form to log in; the user entered the username and password and sent them to the server. The credentials were checked on the server, and if they were correct, a session ID was created and saved in memory, which was then used to exchange requests between the client and server. This approach, although used for years, is vulnerable to external attacks.

Furthermore, modern applications are designed to run on the cloud to scale horizontally, and this session approach saved on a single instance does not lend itself to these scalability needs. This old approach has been replaced by a more modern one, which is based on JWT tokens. In this new mode, the user sends his username and password to the server. After verifying their validity, the server creates a JWT token that can be used in subsequent calls. The client saves this token in the cookies because it is a safe place after saving it on the browser side, and in future requests, it will be added to the call headers.

The server now only has the task of reading the JWT token from the HTTP call headers, and therefore, there is no need for any search in the local memory of the server instance. It is an atomic operation that, as mentioned, lends itself to a distributed system in the Cloud.

You can think of this process as when you check in at a hotel. You present yourself at the reception, providing your data (your credentials), and once everything is verified, you're given the room key. This key is effectively your JWT token, allowing you to access reserved areas such as the gym, the spa, and finally, your room, which can be compared to the reserved area of your application. It should be noted that with the room key, you cannot access the rooms of other hotel guests, and once your stay is over, it will no longer be valid. Just like the room key, the JWT token also has an expiration mechanism, and once it expires, it will no longer allow you to be authenticated. You will need to log in again with your credentials. It may have happened to you that you logged in to your favorite social media and then never logged in again for months, if not years. This can happen because, through a refresh token, which is exchanged with the server, you have the possibility on the client side to extend the expiration of the token itself and allow you to have very long sessions without logging in again with the username and password.

But let's look in detail at how a JWT token is constructed.

// JWT Encoded

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

// JWT Decoded

// Header: algorithm & token type

{
  "alg": "HS256",
  "typ": "JWT"
}

// Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

// Verify signature

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

You can see that the encoded JWT token is constructed in three parts separated by 

Once these three parts have been decoded, you can read their contents. They contain very precise data and are respectively:

This JWT token is effectively a message that is passed back and forth in HTTP calls and, by its nature, is very simple to use. Nowadays, all authentication methods are based on this system, and even the system that you are going to use is based on this procedure and exchange of information. In fact, Supabase, being a modern system based on the Cloud, is certainly no different.

---
title: Let's talk about the Authentication process
description: A custom authentication is too complex and risky to implement from scratch. Let's use the Supabase auth to optimize our goals.
code: https://gitlab.com/fullstackio/books/newline-course-apps/giorgio-boa-qwik-in-action-app/-/tree/main/module_08
---

# Exploring the Authentication Process

Authentication is a fundamental part of every highly dynamic and personalized web application. Authentication refers to the process that identifies a specific user, allowing you to read, write, update, or delete any protected content, depending on your level of authorization. A typical example is a social network, where each user can create personal posts only after authentication, and fortunately, it's not possible to create content on behalf of third parties. This allows for personalizing the experience of using the application for each user and enables you to save configurations and link them to your user profile. Imagine having to save your preference for a dark or light theme; managing authentication makes this possible.

## The Authentication Process is Not as Simple as It Seems

The first thing to ask yourself is whether it makes sense to use an external service for authentication or if you should have full control over the process and manage the entire flow with your service. The custom approach has some complexities that are worth considering. First, you have to think about how to safely save your data to prevent external attacks from reading this valuable information. Then, you have to consider the entire flow in its entirety. It's not just about a simple login; there are other features, such as password recovery and many more.

Imagine that initially, your application allows you to log in with an email and password, but subsequently, you're asked to allow authentication via Google. With a custom solution, you would have to invest some effort to cover this functionality. What if you were then asked to log in to Facebook, too? This would be additional unplanned work at the start of the estimates. The possibility of logging in with different providers is the basis of external services, not to mention the sending of emails and notifications that are necessary for a flow of this type. Do you want to reinvent the wheel and create your own service for sending and translating messages? These problems make it clear why the use of an external service now seems like a solution to at least be carefully considered. In fact, for your e-commerce with Qwik, Supabase Auth will be used.

## JWT Token

In the past, web-side authentication was based on the concept of server-side sessions. The process began by filling out a form to log in; the user entered the username and password and sent them to the server. The credentials were checked on the server, and if they were correct, a session ID was created and saved in memory, which was then used to exchange requests between the client and server. This approach, although used for years, is vulnerable to external attacks.

Furthermore, modern applications are designed to run on the cloud to scale horizontally, and this session approach saved on a single instance does not lend itself to these scalability needs. This old approach has been replaced by a more modern one, which is based on JWT tokens. In this new mode, the user sends his username and password to the server. After verifying their validity, the server creates a JWT token that can be used in subsequent calls. The client saves this token in the cookies because it is a safe place after saving it on the browser side, and in future requests, it will be added to the call headers.

The server now only has the task of reading the JWT token from the HTTP call headers, and therefore, there is no need for any search in the local memory of the server instance. It is an atomic operation that, as mentioned, lends itself to a distributed system in the Cloud.

You can think of this process as when you check in at a hotel. You present yourself at the reception, providing your data (your credentials), and once everything is verified, you're given the room key. This key is effectively your JWT token, allowing you to access reserved areas such as the gym, the spa, and finally, your room, which can be compared to the reserved area of your application. It should be noted that with the room key, you cannot access the rooms of other hotel guests, and once your stay is over, it will no longer be valid. Just like the room key, the JWT token also has an expiration mechanism, and once it expires, it will no longer allow you to be authenticated. You will need to log in again with your credentials. It may have happened to you that you logged in to your favorite social media and then never logged in again for months, if not years. This can happen because, through a refresh token, which is exchanged with the server, you have the possibility on the client side to extend the expiration of the token itself and allow you to have very long sessions without logging in again with the username and password.

But let's look in detail at how a JWT token is constructed.

```typescript
// JWT Encoded

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

// JWT Decoded

// Header: algorithm & token type

{
  "alg": "HS256",
  "typ": "JWT"
}

// Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

// Verify signature

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
```