J
jeremy
3 minutes
Writing the Sign-Up Route That Creates an Account
The sign-up route takes an email and a password from a request, checks they are the right shape, creates exactly the fields you intend, and answers with a created status and a body that does not contain the hash. When two people claim the same email at the same instant, the database refuses the second one with a duplicate-key error, and the route turns that into a polite conflict answer instead of a crash. Only naming the fields yourself stops a caller from smuggling in extras like an admin role. Trust the request body wholesale and your first user can sign themselves up as an administrator.