You know you're supposed to hash and salt passwords. But what actually goes into a secure authentication system once you get past "call this library"?

In this hands-on workshop, you build a complete authentication system from the ground up, starting from a bare static HTML frontend (provided) and ending with a working, defensible login flow behind it. Implement registration with salted (and peppered) password hashing, login with session handling, account lockout, and a full password reset flow — plus the design decisions that separate "it compiles" from "it's actually secure."

You'll use whatever backend stack you want for this workshop, or you can follow along step-by-step with the provided C# reference implementation.

You'll leave with a working authentication system in a language you actually use, plus a checklist of the decisions to revisit the next time you build or audit a login flow.