The guide
The guide
This guide is one story, told from start to finish. You are building a small notes app, and Alice is one of its first users. Over nine short chapters you will give Alice a way to sign in, watch what happens on the wire when Alice does, write your own side of it, and then follow Alice through the harder days: a second laptop, a lost phone, and the morning when nothing Alice owns can sign in any more. The story ends with Parvus running in production and a clear picture of what it protects.
Read it in order the first time. Each chapter starts where the previous one stopped, and the reference section is there for later, when you know what you are looking for.
What sign-in looks like without passwords, and the part Parvus takes off your hands.
Run Parvus and an example app, and register Alice in your browser.
The two round trips behind every registration and sign-in.
The four things your backend does, in any language.
Alice adds a laptop, and the rule that stops an account from being locked by its own owner.
One recovery code, and what Alice does after getting back in.
Resetting an account and handing it back to its owner.
Secrets, sockets, SQLite or Postgres, and a service that restarts cleanly.
The threats Parvus answers, and the ones it leaves to you.