Web Development · Advanced level

Advanced level · Module 6: Web Development Capstone · Lesson 2 of 5

Building the Back End

Implement the database, migrations, API endpoints, authentication and authorisation.

In this lesson you will

  • Implement the API with secure authentication and roles
  • Test the API, including access control and conflicts

Key concepts

migrationsendpointssessions and rolesAPI tests

The lesson

Implement migrations, then endpoints story by story. Add authentication and role checks before building the staff features that need them.

Write tests for the business rules and for security: a customer cannot see another's booking, a receptionist cannot manage staff, a double booking returns 409.

Keep the API contract up to date as you discover details, and tell the front-end side of the team about every change.

Step by step

  1. Implement migrations and seed data.
  2. Implement booking and service endpoints.
  3. Add authentication and role checks.
  4. Write API tests for rules and access control.

Practice activity

Complete milestone 2: the tested, secured API.

Expected result: All API tests pass, including access-control and double-booking tests.

Check your understanding

  1. Which tests prove access control works?

    Show answer

    Tests that try forbidden actions as each role and expect 403 or 404.

  2. Why add authentication before staff features?

    Show answer

    So the features are protected from the moment they exist.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.