You Do Not Need a Login Page
To identify users, a web page needs sign-up, login, and password recovery. A Mini Program does not: when the user opens it, they are already logged in to WeChat, and WeChat gives them an openid, which is "this person's unique ID inside your Mini Program."
Last lesson's "only the creator can read and write" in the cloud database relies on openid behind the scenes: every record automatically carries the writer's openid, and queries automatically return only your own.
Fetch openid Inside a Cloud Function
Front-end code runs on the user's phone, and the user can tamper with it. So do not fetch openid on the front end; fetch it in a cloud function. Cloud functions run on WeChat's servers, and WeChat injects the caller's openid directly, so the front end cannot fake it.
Have Claude Code write your first cloud function:
// cloudfunctions/getOpenid/index.js
const cloud = require('wx-server-sdk');
cloud.init();
exports.main = async () => {
const { OPENID } = cloud.getWXContext();
return { openid: OPENID };
};
// 前端调用
const { result } = await wx.cloud.callFunction({ name: 'getOpenid' });When do you actually need avatar and nickname? Only when you need to display them to other people (leaderboards, comments). A to-do list does not, so do not pop up the authorization dialog; it just annoys users.
自测 · 学完检查一下
想真正动手做题、记进度、攒连胜？到互动课里练。
Xiao Yang plans to build a "phone number + password" sign-up and login page for the to-do Mini Program. According to this lesson, what is the problem?
答案：It is redundant: WeChat already identifies the user via openid, and the cloud database already isolates data by it
A Mini Program has identity built in. Building your own account and password system only adds user drop-off and maintenance for you. Unless you need users to log in to the same account on the web, you do not need it.
The AI proposes "let the user type a username on the front end as their identity and store it in the database to separate data." What is wrong with this plan?
答案：Anything typed on the front end can be changed by the user; change it to someone else's username and you see their data. Identity should come from the openid in a cloud function
The core requirement of identity is "cannot be faked." Any input from the front end can be changed; only the openid WeChat injects into the cloud function on the server side is trustworthy. This is the most basic rule of security.
True or false: the to-do Mini Program should pop up a request for the user's avatar and nickname as soon as the home page opens, because it looks more professional.
答案：False
Avatar and nickname are only needed when you display them to others. A to-do list has no such scenario; an authorization pop-up just makes users want to close it in the first second, and "requesting information unrelated to the feature" is a common reason for review rejection.
You want to add a "most to-dos completed this week" leaderboard. Which approach is correct?
答案：Count each user's completions by openid in a cloud function; request nickname and avatar only from users who make the board, for display
The count spans users; the front end cannot pull other people's data because of permissions, and should not, so it is done in a cloud function. Nicknames are only needed at display time, which fits "request only when needed." Opening permissions to everyone exposes everyone's to-dos to everyone.