Monday, December 30, 2024 – Last week, I continued developing the CRUD API for an entity designed to manage metadata on the backend. This entity follows a schema similar to others and is accessible to admins. Once the API development was complete, I ran tests, all of which passed successfully.
With the backend portion done, I transitioned to the UI development. Later, Mr. Peter informed me that the API for another entity was ready for use, which allowed me to begin integrating it into the UI.
I started by implementing the create API into the existing UI. After confirming that the entity could be created without issues, I shifted my focus to the sign-in functionality. Initially, I took a straightforward approach, simply executing the sign-in API command. However, I realized that my implementation might not be entirely correct, as it lacked a mechanism to track whether the entity was logged in.
To refine my approach, I referred to a developed project for guidance. In the reference project, the implementation involved storing the entity’s data and token within the application. This allowed other parts of the application to access the login status when required.
Towards the end of the week, I adopted the same approach in my project. However, the code is still unable to retrieve the login status. I concluded that I might not have stored the data and token correctly, which will require further debugging and adjustments in the coming week.
Last week, I focused on developing the UI for the sign-in functionality. During this process, I discovered an intriguing security feature: the token received from the API is frequently used to retrieve data that requires authorization. This piqued my interest, as I had always wondered how authorization is managed on the front end.
The token is retrieved and then stored in a cookie. A cookie is a small piece of data stored on the user’s device by their web browser. It allows the website to remember information about the user, such as authentication details, across sessions or requests.
In addition to the sign-in page, I worked on creating related UI elements, such as the edit page. One aspect I found particularly interesting was the process of calling an API to retrieve an entity. To ensure that the user making the request has the necessary privileges, the token must be sent for validation. Unlike passing an ID directly in the URL, which could expose sensitive data, the token is sent securely in the request headers.
This was my first time encountering token-based authorization in this way, and it was a fascinating learning experience.
Next, I shifted to working on another entity. I started by designing the UI, incorporating a dropdown button that supports nested input fields. These fields are dynamically populated based on data retrieved from the API. Once the UI was complete, I moved to the backend to create the API query list that the UI would use.