In this video.
Let's go ahead and implement what is called low level authentication with encryption.
We are going to improve the previous one, which is low level authentication without encryption.
When I say encryption, what do I mean?
Let me show you something here inside our database.
You can see that we are saving the plain password of the user inside our database, but instead we are
going to save random string of characters of the password inside our PDB.
So let's take it that if our application got hacked and then a hacker got to know the user password,
which is 1 to 3 mini the plain password.
And it can happen that this particular user is using this password for his important application, like
banking application.
In that way we are exposing the user into big problems, so we need to avoid that.
So like I said, we are going to work on the password field instead of just plain password.
We are going to save random string of characters, which would be difficult for a hacker to remember.
So that's what I mean.
Encryption.
So back to a visual code.
Let's make changes to the text on the home page.
This is for the low level authentication.
So let me get back to the templates and on that for the index.
Let me change the text to low level authentication with.
Encryption.
Good.
So let's save it and let's refresh it.
And it's correct with encryption.
And also, I'm going to change some taps here for the profile, unless you log in and then automatically
it will direct you to your profile page.
And I'm going to add one more page code protected.
And that way you better understand what is called authorization and authentication.
So back to the project, I'm going to copy a template for profile.
All right, so let's get into that.
So for the profile, I'll copy that and paste and change this one to, let's say, protected.
As that.
So let's go ahead and then render that.
So instead of profile, we are going to make use of the protected.
So let's go to Pasha's and inside my navigation links.
Let me change this one to protect it.
And then the roots is going to be as protected also.
All right.
So now let's go ahead and create a route to render that template so I can copy any of this route.
Let me look at the easiest one, this one.
And down here I can paste it and change this one to protect it.
Root and the template is going to be as protected.
Perfect.
Now let's save it and let's refresh the application.
And now I see protected when I click on that where it's not found, meaning that the root is not well
defined.
So I have to change this one to protect it also.
So now let's see when I refresh it and I click on this one where I got this random error here.
Don't worry, it's because we're not passing anything into the template.
So let's go to the template and remove those dynamic data.
So inside the protected templates, you can see that you're passing some data onto the page.
So let's remove these values here as that and as that and as that.
And for the image too, let's remove the image and let's remove the logout.
Also here I want to show you that it is protected.
That is all or better, so we can remove the text inside that and let's rename this one to protect it.
Good.
So here we go.
So now let's go ahead and refresh it and everything will be correct now protected.
I think the title here is supposed to be protected.
Let's say welcome.
To.
Your protected page.
All right, let's get started with the actual concept.
So now back to the server file.
The first step is that we need to hash the user password before it's even saved into our database.
And this is where we are going to implement that.
When I say hash, what I mean is that we are going to pass the plain password into a function and that
function is going to generate some random string of characters.
And that is what I mean, hash password.
And like I said, we can use the built in module code crypto to get it done, but we have a package
called B equipped JS that is going to make our life easier for hashing.
And this is the package.
If you search for decrypt JS and PM, you're going to see this beautiful page.
So if you scroll down looking at the downloads per way, that is over 1 million.
It tells you how popular this package is.
So let's go ahead and install this beautiful package.
So let's open our Termina and get started with that.
So I'm going to shut down my server like that and let me clear the terminal and install the package
and I be creeped.
JS And make sure that you install the exact version which is 2.4.3 in that way.
After a month or years, your code would be the same as mine in case going to be a new version that
will be incorporated.
So let's go ahead and install the exact version as I'm doing here.
2.4.3 So let's hit enter and now Decrypt is installing it as finished and let me run the server.
Right now the server is running, so let's collapse the terminal.
So now let's go ahead and implement the logic.
Good.
So how are we going to use it?
So we need to require the package above here.
Let me remove the unused module here and let's require the package b script is equal to required.
And going to be be equipped.
DJs So let's get going.
So let's look at the flow here inside the registration route.
That's where we are going to incorporate that.
So first of all, we need to take the plane password and pass to the beep script for hashing before
saving it.
So because of that, let's go ahead and structure the record body.
So here these are going to be cast.
My objects is equal to req dart body and in here I have access to the foo name, the username and then
the password.
And for this one we can simplify.
This one is that instead of this one we can use foo name also.
And here too we can use the username and the password also as password I start and from ESX if the property
and the value are the same, we can choose to write one.
So this one it is same as this.
Likewise this one and likewise this one.
Now our code looks cleaner than before.
So the next step is I want to use async as a way to make our code cleaner.
So let me convert promise to async await.
You can stick to promise or callback, but async await is cleaner.
Good.
So here let's remove the dot then here and let's await the details here with that good.
If something goes wrong for now, let's ignore the error handling.
So how are we going to hash the user password?
And here we go.
First of all, we need to create sorts.
So step number one is create sort.
And this thought is going to be the result from the package that we are going to make use of it.
So here we go.
Cost starts is equal to be create package that we have required above there, which is this one.
And on that we have a method called gen dot, dot gen sort and we have two methods gen sort sync and
gen sort.
This one is for synchronous way and let's stick to the asynchronous way and here we pass in a value
to get a source.
Good.
So here the higher the value, the more secure the source would be, but the higher the value is going
to slow down your application.
So by convention or the ID value is ten.
So with this one, if a console looks soft, you're going to see that we get some random string of characters.
And after that, step number two is we need to hash the user password going to be hash, user password
as that and how are we going to do it?
The same method we got from decrypt on that you're going to make use of hashed.
Password.
Is equal to let's await be equipped and the be equipped package and we have a method called hash and
here we pass in the password or the data you want to hash, which is our password here we pass in as
that and come on we pass in the sort we got from decrypt and that is all.
So now instead of saving the plain password, we are going to save the hash password instead.
So here we go, colon and then the hash password.
And that is it, guys, and that is it.
So let's have a look.
Now our server has restarted.
Let's go ahead and register from the front end and let's see.
So this time around let's go to the register and let's register as email and the username going to be
lowercase ima and one, two, three, four, five and let's hit register where my server is down.
Why is this?
So let me check the terminal and see what is wrong.
Or the problem is that we need to await this operation also.
So here are going to be a wait.
Good.
So now let's save it.
Now our server has restarted.
Let's go ahead and register a user called EMA.
So click on register and the full name is going to be Emma and lowercase Emma.
And one, two, three, four, five.
Let's hit register now.
Moment of truth.
Our server is working.
So let's go ahead and check.
And there you go.
You can see that now, instead of playing password, we have what?
Save this hashed pass where we add some string of characters.
So for this particular password, we're going to be very difficult for a user to remember.
Good.
So maybe asking then how can we log in with this?
Are you going to remember the string of characters before we can log in?
And the answer is no.
All what you need to remember is a password you use to register, and that is all.
So let me show you how we are going to log in in the next video.