Authentication

A login form that answers "this email doesn't exist" in 12 milliseconds and "incorrect password" in 180 milliseconds gives away for free which accounts exist on your service. The attacker doesn't even need to read the message: the timing difference is enough, because the "unknown email" path skips the hashing step. Given a list of ten million addresses from a previous breach, they can extract the exact list of your users in a few hours, then concentrate their attempts on them.

This kind of detail sums up authentication: the main mechanism is simple to write, and it's the periphery that opens the gaps. A cookie without the HttpOnly attribute, a role check applied to the request body rather than to the token, a logout that invalidates nothing, a secret comparison done with ===. This lesson covers the happy path quickly so it can spend most of its time on these peripheral concerns, because that's where incidents happen.

Passwords

A password isn't encrypted, it's hashed — the operation must be irreversible. And not with SHA-256: those functions are designed to be fast, which is exactly the opposite of what you want. Use a slow, tunable function, preferably argon2id, or bcrypt as a fallback.