1
00:00:08,300 --> 00:00:09,380
In this video.

2
00:00:09,380 --> 00:00:16,700
Let's go ahead and implement what is called low level authentication with encryption.

3
00:00:17,030 --> 00:00:24,290
We are going to improve the previous one, which is low level authentication without encryption.

4
00:00:24,560 --> 00:00:27,620
When I say encryption, what do I mean?

5
00:00:27,740 --> 00:00:31,370
Let me show you something here inside our database.

6
00:00:31,610 --> 00:00:39,530
You can see that we are saving the plain password of the user inside our database, but instead we are

7
00:00:39,530 --> 00:00:45,110
going to save random string of characters of the password inside our PDB.

8
00:00:45,380 --> 00:00:52,070
So let's take it that if our application got hacked and then a hacker got to know the user password,

9
00:00:52,070 --> 00:00:54,980
which is 1 to 3 mini the plain password.

10
00:00:55,280 --> 00:01:02,870
And it can happen that this particular user is using this password for his important application, like

11
00:01:02,870 --> 00:01:04,550
banking application.

12
00:01:04,910 --> 00:01:11,660
In that way we are exposing the user into big problems, so we need to avoid that.

13
00:01:11,660 --> 00:01:17,660
So like I said, we are going to work on the password field instead of just plain password.

14
00:01:17,690 --> 00:01:24,090
We are going to save random string of characters, which would be difficult for a hacker to remember.

15
00:01:24,110 --> 00:01:25,660
So that's what I mean.

16
00:01:25,670 --> 00:01:26,750
Encryption.

17
00:01:26,750 --> 00:01:29,090
So back to a visual code.

18
00:01:29,090 --> 00:01:32,360
Let's make changes to the text on the home page.

19
00:01:32,370 --> 00:01:35,360
This is for the low level authentication.

20
00:01:35,360 --> 00:01:41,450
So let me get back to the templates and on that for the index.

21
00:01:41,450 --> 00:01:45,830
Let me change the text to low level authentication with.

22
00:01:47,590 --> 00:01:48,730
Encryption.

23
00:01:51,790 --> 00:01:52,480
Good.

24
00:01:52,540 --> 00:01:55,180
So let's save it and let's refresh it.

25
00:01:55,180 --> 00:01:58,030
And it's correct with encryption.

26
00:01:58,120 --> 00:02:05,590
And also, I'm going to change some taps here for the profile, unless you log in and then automatically

27
00:02:05,590 --> 00:02:07,990
it will direct you to your profile page.

28
00:02:07,990 --> 00:02:11,740
And I'm going to add one more page code protected.

29
00:02:11,740 --> 00:02:16,870
And that way you better understand what is called authorization and authentication.

30
00:02:16,960 --> 00:02:23,800
So back to the project, I'm going to copy a template for profile.

31
00:02:23,890 --> 00:02:25,960
All right, so let's get into that.

32
00:02:25,960 --> 00:02:33,370
So for the profile, I'll copy that and paste and change this one to, let's say, protected.

33
00:02:34,620 --> 00:02:35,430
As that.

34
00:02:35,430 --> 00:02:38,010
So let's go ahead and then render that.

35
00:02:38,010 --> 00:02:43,230
So instead of profile, we are going to make use of the protected.

36
00:02:43,230 --> 00:02:47,190
So let's go to Pasha's and inside my navigation links.

37
00:02:47,190 --> 00:02:50,250
Let me change this one to protect it.

38
00:02:50,700 --> 00:02:55,470
And then the roots is going to be as protected also.

39
00:02:55,950 --> 00:02:56,520
All right.

40
00:02:56,520 --> 00:03:03,240
So now let's go ahead and create a route to render that template so I can copy any of this route.

41
00:03:03,240 --> 00:03:05,700
Let me look at the easiest one, this one.

42
00:03:06,000 --> 00:03:11,610
And down here I can paste it and change this one to protect it.

43
00:03:14,030 --> 00:03:19,400
Root and the template is going to be as protected.

44
00:03:19,430 --> 00:03:20,000
Perfect.

45
00:03:20,030 --> 00:03:24,170
Now let's save it and let's refresh the application.

46
00:03:24,170 --> 00:03:31,340
And now I see protected when I click on that where it's not found, meaning that the root is not well

47
00:03:31,340 --> 00:03:32,090
defined.

48
00:03:32,240 --> 00:03:35,870
So I have to change this one to protect it also.

49
00:03:35,900 --> 00:03:42,590
So now let's see when I refresh it and I click on this one where I got this random error here.

50
00:03:42,620 --> 00:03:46,390
Don't worry, it's because we're not passing anything into the template.

51
00:03:46,400 --> 00:03:50,570
So let's go to the template and remove those dynamic data.

52
00:03:50,570 --> 00:03:56,810
So inside the protected templates, you can see that you're passing some data onto the page.

53
00:03:56,840 --> 00:04:07,580
So let's remove these values here as that and as that and as that.

54
00:04:07,580 --> 00:04:12,910
And for the image too, let's remove the image and let's remove the logout.

55
00:04:12,920 --> 00:04:16,339
Also here I want to show you that it is protected.

56
00:04:16,339 --> 00:04:23,210
That is all or better, so we can remove the text inside that and let's rename this one to protect it.

57
00:04:24,140 --> 00:04:24,820
Good.

58
00:04:24,830 --> 00:04:27,000
So here we go.

59
00:04:27,020 --> 00:04:32,260
So now let's go ahead and refresh it and everything will be correct now protected.

60
00:04:32,420 --> 00:04:36,950
I think the title here is supposed to be protected.

61
00:04:37,040 --> 00:04:38,480
Let's say welcome.

62
00:04:41,070 --> 00:04:41,940
To.

63
00:04:42,920 --> 00:04:45,350
Your protected page.

64
00:04:46,570 --> 00:04:49,820
All right, let's get started with the actual concept.

65
00:04:49,840 --> 00:04:52,150
So now back to the server file.

66
00:04:52,270 --> 00:05:00,300
The first step is that we need to hash the user password before it's even saved into our database.

67
00:05:00,310 --> 00:05:03,230
And this is where we are going to implement that.

68
00:05:03,250 --> 00:05:10,360
When I say hash, what I mean is that we are going to pass the plain password into a function and that

69
00:05:10,360 --> 00:05:14,560
function is going to generate some random string of characters.

70
00:05:14,560 --> 00:05:17,360
And that is what I mean, hash password.

71
00:05:17,380 --> 00:05:24,010
And like I said, we can use the built in module code crypto to get it done, but we have a package

72
00:05:24,010 --> 00:05:28,780
called B equipped JS that is going to make our life easier for hashing.

73
00:05:28,780 --> 00:05:30,790
And this is the package.

74
00:05:30,820 --> 00:05:36,250
If you search for decrypt JS and PM, you're going to see this beautiful page.

75
00:05:36,250 --> 00:05:41,440
So if you scroll down looking at the downloads per way, that is over 1 million.

76
00:05:41,440 --> 00:05:44,230
It tells you how popular this package is.

77
00:05:44,230 --> 00:05:47,680
So let's go ahead and install this beautiful package.

78
00:05:47,830 --> 00:05:51,670
So let's open our Termina and get started with that.

79
00:05:51,670 --> 00:06:00,280
So I'm going to shut down my server like that and let me clear the terminal and install the package

80
00:06:00,280 --> 00:06:03,400
and I be creeped.

81
00:06:05,380 --> 00:06:12,820
JS And make sure that you install the exact version which is 2.4.3 in that way.

82
00:06:12,850 --> 00:06:19,660
After a month or years, your code would be the same as mine in case going to be a new version that

83
00:06:19,660 --> 00:06:20,770
will be incorporated.

84
00:06:20,800 --> 00:06:24,170
So let's go ahead and install the exact version as I'm doing here.

85
00:06:24,190 --> 00:06:32,710
2.4.3 So let's hit enter and now Decrypt is installing it as finished and let me run the server.

86
00:06:33,670 --> 00:06:38,080
Right now the server is running, so let's collapse the terminal.

87
00:06:38,080 --> 00:06:41,290
So now let's go ahead and implement the logic.

88
00:06:41,290 --> 00:06:41,830
Good.

89
00:06:41,830 --> 00:06:43,720
So how are we going to use it?

90
00:06:43,720 --> 00:06:47,060
So we need to require the package above here.

91
00:06:47,110 --> 00:06:56,650
Let me remove the unused module here and let's require the package b script is equal to required.

92
00:06:57,680 --> 00:06:59,970
And going to be be equipped.

93
00:07:00,020 --> 00:07:02,810
DJs So let's get going.

94
00:07:03,080 --> 00:07:08,300
So let's look at the flow here inside the registration route.

95
00:07:08,300 --> 00:07:10,120
That's where we are going to incorporate that.

96
00:07:10,130 --> 00:07:18,050
So first of all, we need to take the plane password and pass to the beep script for hashing before

97
00:07:18,050 --> 00:07:18,860
saving it.

98
00:07:18,860 --> 00:07:24,050
So because of that, let's go ahead and structure the record body.

99
00:07:24,050 --> 00:07:26,900
So here these are going to be cast.

100
00:07:26,900 --> 00:07:38,780
My objects is equal to req dart body and in here I have access to the foo name, the username and then

101
00:07:38,780 --> 00:07:40,550
the password.

102
00:07:40,550 --> 00:07:42,770
And for this one we can simplify.

103
00:07:42,770 --> 00:07:47,600
This one is that instead of this one we can use foo name also.

104
00:07:47,720 --> 00:08:01,040
And here too we can use the username and the password also as password I start and from ESX if the property

105
00:08:01,040 --> 00:08:04,640
and the value are the same, we can choose to write one.

106
00:08:04,640 --> 00:08:06,800
So this one it is same as this.

107
00:08:06,800 --> 00:08:11,240
Likewise this one and likewise this one.

108
00:08:11,240 --> 00:08:13,760
Now our code looks cleaner than before.

109
00:08:14,060 --> 00:08:18,500
So the next step is I want to use async as a way to make our code cleaner.

110
00:08:18,500 --> 00:08:21,590
So let me convert promise to async await.

111
00:08:21,710 --> 00:08:25,700
You can stick to promise or callback, but async await is cleaner.

112
00:08:25,880 --> 00:08:26,270
Good.

113
00:08:26,270 --> 00:08:35,390
So here let's remove the dot then here and let's await the details here with that good.

114
00:08:35,659 --> 00:08:39,470
If something goes wrong for now, let's ignore the error handling.

115
00:08:39,470 --> 00:08:42,530
So how are we going to hash the user password?

116
00:08:42,530 --> 00:08:43,730
And here we go.

117
00:08:44,090 --> 00:08:46,310
First of all, we need to create sorts.

118
00:08:46,310 --> 00:08:51,020
So step number one is create sort.

119
00:08:51,760 --> 00:08:56,490
And this thought is going to be the result from the package that we are going to make use of it.

120
00:08:56,500 --> 00:08:57,310
So here we go.

121
00:08:57,310 --> 00:09:06,580
Cost starts is equal to be create package that we have required above there, which is this one.

122
00:09:06,880 --> 00:09:16,450
And on that we have a method called gen dot, dot gen sort and we have two methods gen sort sync and

123
00:09:16,450 --> 00:09:17,130
gen sort.

124
00:09:17,140 --> 00:09:24,460
This one is for synchronous way and let's stick to the asynchronous way and here we pass in a value

125
00:09:24,460 --> 00:09:25,870
to get a source.

126
00:09:25,900 --> 00:09:26,320
Good.

127
00:09:26,320 --> 00:09:32,860
So here the higher the value, the more secure the source would be, but the higher the value is going

128
00:09:32,860 --> 00:09:34,930
to slow down your application.

129
00:09:34,930 --> 00:09:38,500
So by convention or the ID value is ten.

130
00:09:38,590 --> 00:09:44,530
So with this one, if a console looks soft, you're going to see that we get some random string of characters.

131
00:09:44,530 --> 00:09:55,870
And after that, step number two is we need to hash the user password going to be hash, user password

132
00:09:55,870 --> 00:09:58,180
as that and how are we going to do it?

133
00:09:58,210 --> 00:10:04,090
The same method we got from decrypt on that you're going to make use of hashed.

134
00:10:05,390 --> 00:10:06,950
Password.

135
00:10:08,960 --> 00:10:17,870
Is equal to let's await be equipped and the be equipped package and we have a method called hash and

136
00:10:17,870 --> 00:10:25,940
here we pass in the password or the data you want to hash, which is our password here we pass in as

137
00:10:25,940 --> 00:10:32,510
that and come on we pass in the sort we got from decrypt and that is all.

138
00:10:32,510 --> 00:10:38,090
So now instead of saving the plain password, we are going to save the hash password instead.

139
00:10:38,090 --> 00:10:42,470
So here we go, colon and then the hash password.

140
00:10:42,470 --> 00:10:45,290
And that is it, guys, and that is it.

141
00:10:45,290 --> 00:10:46,760
So let's have a look.

142
00:10:46,910 --> 00:10:49,700
Now our server has restarted.

143
00:10:49,700 --> 00:10:53,330
Let's go ahead and register from the front end and let's see.

144
00:10:53,420 --> 00:11:02,060
So this time around let's go to the register and let's register as email and the username going to be

145
00:11:02,090 --> 00:11:08,840
lowercase ima and one, two, three, four, five and let's hit register where my server is down.

146
00:11:08,840 --> 00:11:09,650
Why is this?

147
00:11:09,650 --> 00:11:13,640
So let me check the terminal and see what is wrong.

148
00:11:13,670 --> 00:11:18,320
Or the problem is that we need to await this operation also.

149
00:11:18,320 --> 00:11:20,720
So here are going to be a wait.

150
00:11:21,930 --> 00:11:22,400
Good.

151
00:11:22,410 --> 00:11:23,550
So now let's save it.

152
00:11:23,680 --> 00:11:25,800
Now our server has restarted.

153
00:11:26,010 --> 00:11:29,680
Let's go ahead and register a user called EMA.

154
00:11:29,700 --> 00:11:35,070
So click on register and the full name is going to be Emma and lowercase Emma.

155
00:11:35,070 --> 00:11:37,020
And one, two, three, four, five.

156
00:11:37,110 --> 00:11:39,450
Let's hit register now.

157
00:11:39,480 --> 00:11:40,710
Moment of truth.

158
00:11:40,740 --> 00:11:42,720
Our server is working.

159
00:11:42,900 --> 00:11:45,420
So let's go ahead and check.

160
00:11:45,420 --> 00:11:47,190
And there you go.

161
00:11:47,220 --> 00:11:52,050
You can see that now, instead of playing password, we have what?

162
00:11:52,050 --> 00:11:56,540
Save this hashed pass where we add some string of characters.

163
00:11:56,550 --> 00:12:01,650
So for this particular password, we're going to be very difficult for a user to remember.

164
00:12:01,830 --> 00:12:02,430
Good.

165
00:12:02,430 --> 00:12:06,390
So maybe asking then how can we log in with this?

166
00:12:06,400 --> 00:12:10,590
Are you going to remember the string of characters before we can log in?

167
00:12:10,590 --> 00:12:12,990
And the answer is no.

168
00:12:13,110 --> 00:12:19,410
All what you need to remember is a password you use to register, and that is all.

169
00:12:19,560 --> 00:12:23,550
So let me show you how we are going to log in in the next video.