Fix Fake Auth

Your login 'works' but nothing is real: convert visual-only auth into persisted users, sessions, and guards.

6 steps18 verify checks45-90 minutesWorks with: emergent · chatgpt · claude · cursor

Start Guided Walkthrough

#auth #fake #sessions #login #security

The Route

0/6 verified

Diagnose what is fake

Map exactly which parts of auth are theater before rebuilding.

3 checks 02

Implement real user persistence

Signup must create actual users with hashed passwords.

3 checks 03

Implement real credential verification

3 checks 04

Implement session persistence and logout

Auth state must live somewhere durable, restored on load.

3 checks 05

Enforce guards on routes and APIs

Protection must exist in two layers: router and backend.

3 checks 06

Full auth verification

Run the complete honest test suite on the rebuilt auth.

3 checks

Every step ends at a Verify Gate. Do not continue until every check passes.

Context Pack

Paste this first. It briefs the AI on requirements, constraints, and the Definition of Done before your first build prompt.

Context Pack

PROJECT CONTEXT:
My app has signup/login screens that appear to work but do not create real users or protect anything.

GOAL:
Replace fake auth with real user records, credential verification, persistent sessions, and enforced route protection.

REQUIREMENTS:
- Signup creates real persisted user records
- Login verifies against stored hashed passwords
- Sessions survive refresh
- Protected routes and APIs actually reject the logged-out
- Visible error states everywhere

CONSTRAINTS:
- No plaintext passwords
- No auth state living only in a React variable
- Backend endpoints must enforce auth independently of the UI

DEFINITION OF DONE:
- A created user exists in the database with a hashed password
- Wrong credentials fail visibly; right ones succeed
- Refresh keeps the session
- Direct URL access to protected pages redirects when logged out

COMMON FAILURES TO AVOID:
- Login that accepts any credentials
- Auth state in memory only, gone on refresh
- Protected pages reachable by URL
- APIs serving private data without any session check

Paste this into your AI builder first. It teaches the AI what you want before you give it the build prompt.