Key point
One idea
Auth is not one feature. It is a chain. If one link is weak, the whole sign-in flow becomes easy to break.
Your job is not to invent security. Your job is to use proven tools, make clear choices, and document what you checked.
What goes wrong
Most broken student auth is not broken by advanced hacking. It is broken by simple mistakes: saving plain passwords, trusting the browser too much, leaking secrets, or protecting only the button instead of the server route.
A recruiter inspecting your repo will not expect bank-grade security. They will expect you to know the basic traps and avoid them on purpose.