Welcome back.
In this video, let's implement the login functionality and this is a route that renders the client
side.
For the meantime, we are going to use the front end or the client or the browser, but instead we are
using Postman everything at the back end.
So now this one is for getting the form.
So our code is one get login form or login form and I can copy this one and down here let me paste it
here and going to be the login logic.
Here we go and going to be post requests.
All right.
So how are we going to log in?
So here we go.
Let's look at the step.
Step number one is get the username and password.
So where can we get the person username and password?
We can get it from here when you are making the request using this tool.
Okay, so how are we going to get them?
We can get them from the red dot body so we can go ahead and restructure that.
But let's move step by step by saying that username is equal to req dart body dart username.
And for this one you can log in with the person, full name or email or phone number.
The choice is yours.
The next is get the password.
So let's.
According to one US user password.
Is equal to rec dot body dot password.
So back to the request here or the client here, we are going to make a request to this endpoint.
Log in.
But before we do that, let's make sure that we are getting the data.
So let's console log the username.
And then the user password or password can be that also.
So now let's go ahead and create one request.
So click on the ten client here and now let's duplicate this one and let's rename this 1 to 6.
Log in.
All right.
So here are going to be the log in.
Let's have some room to enter the details.
So for log in, we don't need to pass in the full name, but we need to pass in the username and then
the password.
So let's hit send and let's check our terminal and let's see if everything is working perfectly, which
is this one.
And indeed I have the data down here as Johnny and one, two, three.
All right.
So we are almost there.
So after getting that, the next step is find the user.
Inside.
MongoDB.
Okay, so here we go.
First of all, we are going to find this particular user.
I'm going to find the user by username.
So here we go.
Const user found, which is equal to for this case, let's make use of async await because we want to
talk to MongoDB.
We need to handle the promises.
Okay, so here, let's await the user model on that.
I'm going to find one find one we can pass in any query.
So here we want to find the user by username, which is equal to username.
Here I can provide as that.
But for SS, if the value and the property name are the same, we can choose the right one.
So this one is same.
Good.
So now let's go ahead and then console.log.
The user found is are found.
So let's go ahead and then make the request again.
We see that I didn't send any response.
That is why my server or the response has hung out.
So don't worry.
Let's click on the log in and let's check the terminal here and it will say that I get back the user,
which is nice.
See, so here let's also check if the user is not found, then we can throw an error for the meantime
because we haven't talked about error handling.
Let's do some custom error.
So here if.
There is no user found.
Then we are going to say that.
Let's return and just send this data here to the user.
This is not the ideal way of handling this kind of error.
But for the meantime, let's talk to that as you move on.
When we get to error handling.
I will show you how we can handle this one perfectly.
So here, let's provide a property code message and we say that.
Invalid.
Username.
Good.
So now.
Errors down here.
Errors.
Then we can return rez dot json and we are going to say message and it says that log in.
Suck.
Six.
Perfect.
And if you want to send a user, why not go ahead and send the user found?
That's a user.
So now let's go ahead and make the request.
So now back to login requests.
Let's hit sign and you can see that we got login success with the user which is inside my DB.
That is awesome.
But let's say that if I change the username to something like this one and let's send and you can see
that we get invalid username meaning that there is no user by joining to that, is it?
But if I try to provide this one by the for the password, I can enter anything.
When I hit send you could see that we got login success even though the password is wrong.
Why is it so we got it because we are not checking the password as well.
So here we can check that if there is no user or the password is not correct.
So how can we check the password?
Well, we're going to be pretty simple, right?
We are also going to compare or find the user by password.
All right.
So here we can copy this one.
And then down here we can pass it and change this one to password.
And here are going to be the user password from the client.
So here, let's change this one to password.
How is that?
So here we are going to check if there is no user or.
There is no password.
Meaning that if there's password, this one going to retain.
True.
Right.
Do you get it?
Yes.
So with this one, we can implement this one in different ways.
But I think making two requests at the same time isn't ideal.
So what we can do is that we can find the user up here with a found, and on that we are going to check
the user name and then the other ones as well.
But for the meantime, let's maintain this as we move on.
We are going to improve our logic.
So now we are taking the password into consideration.
So here let's go ahead and then log in again with those wrong credentials where I still get log in success.
So why is it so?
Well, I need to also inject this one.
Meaning if there is no password, mean that if there is no user found the same thing.
So let's send a non pc see that I got invalid username.
If I change this one to the right password and I signed, I'm able to log in.
Let me give you one security tip here.
So let's say that the user name is found by the password is incorrect.
You shouldn't write something like username is correct, but password is incorrect.
Or you can say that password is incorrect or username is incorrect.
In that way you are giving hand to any hacker.
So what I often use is that invalid login credentials.
Invalid login credentials.
In this way the user might not know whether the password or the username is incorrect.
So this is how we implement it.
All right.
But when we thinking that, what about the profile page?
We can get that one really easily, right?
So on the profile page, we can make the same check here that if this is a found, then we can send
the user details onto the template.
And that is all the same way we are retaining the user here.
We are going to implement the same thing for the profile.
So let's implement this one using a form where we can log in and register from a form.