How do I add email/password login to a web app?

To add email/password login to a web app, you need a few building blocks:

1) Store users securely

Create a users table/collection with at least:

• id
• email (unique)
• password_hash
• created_at

Never store plain-text passwords.
Hash passwords with a slow password hash function like:

• Argon2id (best modern choice)
• bcrypt
• scrypt

2) Registration flow

When a user signs up:

1. Validate email/password
2. Check if email already exists
3. Hash the password
4. Save the user record
5. Optionally send verification email

Pseudo-flow:

POST /register
- email = request.email
- password = request.password

- if user exists: return error
- hash = hash_password(password)
- insert user(email, hash)
- return success

3) Login flow

When a user logs in:

1. Find the user by email
2. Compare the submitted password to the stored hash
3. If valid, create a session or issue a token

Pseudo-flow:

POST /login
- email = request.email
- password = request.password

- user = find_user_by_email(email)
- if no user: return invalid credentials
- if password_verify(password, user.password_hash) fails: return invalid credentials
- create session/token
- return success

4) Keep users authenticated

You have two common approaches:

Option A: Sessions + cookies

Best for many traditional web apps.

• Server creates a session after login
• Browser stores a session cookie
• Cookie should be:
  • HttpOnly
  • Secure
  • SameSite=Lax or Strict when possible

Option B: JWTs

Common for APIs and SPAs.

• Server returns a signed token
• Client sends it on future requests
• Often stored in memory or an HttpOnly cookie

For most web apps, sessions with HttpOnly cookies are simpler and safer.

5) Protect routes

Require authentication on pages or API endpoints:

if no valid session/token:
    redirect to login / return 401

6) Security essentials

At minimum, add:

• Password hashing: Argon2id/bcrypt
• Rate limiting: slow down brute-force attempts
• CSRF protection: if using cookie-based auth
• Email verification: to confirm ownership
• Password reset flow: via time-limited emailed tokens
• Secure cookies: HttpOnly, Secure, SameSite
• HTTPS everywhere

7) Password reset

Typical flow:

1. User requests reset
2. Generate a one-time token with expiration
3. Email the reset link
4. Verify token
5. Let user set a new password
6. Re-hash and store it

8) Recommended implementation shortcuts

If you don’t want to build auth from scratch, use a trusted auth provider or framework:

• Auth.js / NextAuth for Next.js
• Firebase Authentication
• Supabase Auth
• Auth0
• Clerk
• AWS Cognito

These handle many security details for you.

If you want, I can give you:

1. a generic backend example in Node/Python/PHP/etc., or
2. a complete login/register flow for a specific framework like Express, Django, Laravel, Next.js, or Flask.