Log inSign up

ngzvhmcf

sambkw

Public
Sambkw sample website with working email+password authentication
authenticationhonosqlitewebsite
Edit with AI
1 Branch
Val Town is a collaborative website to build and scale JavaScript apps.
Deploy APIs, crons, & store data – all from the browser, and deployed in milliseconds.
Sign up now
index.tsx
README.md

sambkw

A sample website with a complete, working email + password authentication system built on Val Town.

✨ Try it

Visit the live site

Create an account (or log in with the test user sam@example.com / supersecret1), and you'll land on a members-only dashboard.

How it works

CapabilityImplementation
ServerHono + JSX (index.tsx)
Users & sessionsSQLite, scoped to this val (lib/db.ts)
Password hashingPBKDF2 (100k iterations, per-user 16-byte salt) via WebCrypto (lib/security.ts)
SessionsRandom 256-bit token stored in the DB, delivered as an HttpOnly, Secure, SameSite=Lax cookie signed with HMAC-SHA256
Route protection/dashboard requires a valid session; otherwise redirects to /login

Routes

  • GET / — homepage
  • GET/POST /signup — create an account (auto-logs you in)
  • GET/POST /login — sign in
  • POST /logout — destroy the session
  • GET /dashboard — protected page for authenticated users

Security notes

  • Passwords are never stored in plaintext; each is hashed with a unique random salt.
  • Login returns the same error for an unknown email and a wrong password, preventing user enumeration.
  • Session cookies are signed so they can't be forged without SESSION_SECRET, and sessions can be revoked server-side on logout.

Environment variables

  • SESSION_SECRET — secret used to sign session cookies. Set it to a long random string before going to production. It's already configured on this val.

Files

  • index.tsx — HTTP entrypoint (routes + views)
  • lib/security.ts — password hashing and cookie signing
  • lib/db.ts — SQLite schema and queries