Welcome back.
In this video, let's see how we can log in after hashing a user password.
So let's look at the flow.
So this is a route called login where we are going to implement the logic and we are going to refactor
the code inside this route a little bit.
So as we move on, we are always improving our code.
So let's see.
So let's go ahead and remove everything from this route with the exception of the redirect.
So as we did, let's go ahead and restructure the red dot body as before to cost and we need the user
name and then the user password from the red dot body.
Good.
So let's look at the step.
Step number one is.
Check if username.
Exist.
Good.
And how can we get there when we need to talk to our database and find the user by username?
So here we go.
Const user found is equal to await the operation and on the user model we are going to use find one
and for find one we can use any property like email or phone number or any property to find the user
in one database.
So here let's use the user name as that and I can make use of user name as the.
So like I always say that for essays, if the property name and the value are the same, we can write
one which is equally as before.
So now let's check if there is no user.
Okay.
So if.
There is no user found in our database.
It means that this particular user has not been registered yet.
So here we can return from this route.
Here.
Return.
And let's quickly send some message to the user.
For the meantime, let's just send this kind of message as an error.
But it is not.
As we move on, we're going to have a better way to send error messages.
So here we go.
So what we are going to do is that where we can provide a message?
And on that, I'm going to say that user name.
It's not found.
So like I said, if you provide this kind of message, which is is a name is not found, we are giving
more details or hint to any hacker who is trying to log into this application.
So always don't make your message to be more descriptive.
That username is correct, but password is incorrect or password is correct, but username is incorrect.
So always use a message which doesn't seem to be more descriptive.
But for me I always say that invalid.
Login credentials.
In that way, the user might not know whether it is user name or the password.
Great.
All right.
So now at this point, after this point, we assume that there is a user.
Now, here comes the clue.
So step number two is that we are going to check if the password is valid.
So check if password.
Is valid and I'm going to use a method from Decrypt to get the one done.
So let me show you.
So const is password.
Valley.
Is equal to you are going to always be operation.
And the method we have is called the compare.
All right, compare, saying and compare.
If won't use asynchronous way go by this.
But because we are dealing promises let's go by this.
And what are we going to compare?
We are going to compare first is a plane password that is open registration, the password the visa
used, and then the hash password, which is the one inside our database.
And that is all.
So this function returns true or false?
So inside here, let's pass in the password that the plane password from the elected body.
And then inside our DB, we have what is called user dot password.
So you're going to get user found user found dot password.
So here are going to be the user found dot password and that is it.
This method returns true or false.
If it is true, it means that the password is correct.
So here again.
So if.
It is false.
Meaning if there is no password like this one, meaning if password is equal to four.
So this one is same as if password is equal to force.
It is same as so this code is same as this one.
All right.
But normally let's use the inverted way and this will make it cleaner.
Meaning, if it's true, make it false.
If it's false, make it true like that.
So in here we are going to send a message.
Also the same message.
Like I said, don't say that invalid password.
Don't make your message be more descriptive.
So here we assume that the user has been logged in.
So at this point we can go ahead and then redirect the user to the profile page.
So let's see in action.
So back to the page here and now let's refresh it and let's go to log in.
And my username was Emma and password was one, two, three, four, five, let's get sent.
And you can see that where we got the user, but we see that I'm also trying to display the password,
which is not ideal.
So let's go ahead and remove the password from the profile page.
But the good news is that it is working.
So let's remove this line of code from here and now let's refresh it and now welcome.
You can see that my full name and my username and this profile picture is static, meaning irrespective
of who you are, you're going to see this profile image because we have not done what is called file
upload yet.
So that is great.
The good news is that we got it done right.
So what has left is that I want to show you another technique, how we can protect a certain templates.
So for this template, if I click on that, irrespective of being logging in or not, I can still have
access to this and record something session well.
So like I said, for this kind of logging system, everything works fine, but we don't do this one
in real application.
But what you have done so far about the encryption, we are going to use this one a lot.
A lot.
Well, let me show you one more technique here.
Well, let's say that if we haven't log in and you click on this page, we are going to display a message
that log in before accessing this page.
And if the user is log in, we are going to send this kind of message to the user.
So how are you going to do this one?
Well, we need what is called session management because servers are stateless.
So for what we have done so far, well, we are on the right track to implement log in system, but
after logging in our server does not remember who has log in because there is nothing to prove to our
server that I have logging in or you have logging.
Right.
That is why we need what is called session management.
As we move on, we are going to improve this code a little bit.
But let me show you the trick way where we can vote.
Protect this page in this video.