Login is not permission
Distinguish authentication from authorization.
19 minutes
Authentication asks who you are
A login flow establishes an identity and a session. The browser presents its session with later requests. Use a maintained authentication system; understanding the flow does not require inventing password storage or token cryptography.
Authorization asks what you may do
For every progress read and write, the server must scope the operation to the authenticated user. Do not trust a user_id sent by the browser as proof of identity. Test with two accounts: account B must not see or edit account A’s progress.