1 00:00:08,039 --> 00:00:09,240 Welcome back. 2 00:00:09,270 --> 00:00:15,160 In this video, let's see how we can log in after hashing a user password. 3 00:00:15,180 --> 00:00:17,250 So let's look at the flow. 4 00:00:17,460 --> 00:00:25,350 So this is a route called login where we are going to implement the logic and we are going to refactor 5 00:00:25,350 --> 00:00:27,890 the code inside this route a little bit. 6 00:00:27,900 --> 00:00:31,380 So as we move on, we are always improving our code. 7 00:00:31,380 --> 00:00:32,490 So let's see. 8 00:00:32,970 --> 00:00:39,810 So let's go ahead and remove everything from this route with the exception of the redirect. 9 00:00:40,170 --> 00:00:49,290 So as we did, let's go ahead and restructure the red dot body as before to cost and we need the user 10 00:00:49,290 --> 00:00:56,760 name and then the user password from the red dot body. 11 00:00:56,910 --> 00:00:57,470 Good. 12 00:00:57,480 --> 00:00:59,370 So let's look at the step. 13 00:00:59,400 --> 00:01:01,890 Step number one is. 14 00:01:02,710 --> 00:01:06,700 Check if username. 15 00:01:07,920 --> 00:01:08,950 Exist. 16 00:01:09,240 --> 00:01:09,720 Good. 17 00:01:09,720 --> 00:01:16,140 And how can we get there when we need to talk to our database and find the user by username? 18 00:01:16,140 --> 00:01:18,030 So here we go. 19 00:01:18,240 --> 00:01:28,800 Const user found is equal to await the operation and on the user model we are going to use find one 20 00:01:29,070 --> 00:01:36,600 and for find one we can use any property like email or phone number or any property to find the user 21 00:01:36,600 --> 00:01:37,410 in one database. 22 00:01:37,410 --> 00:01:44,060 So here let's use the user name as that and I can make use of user name as the. 23 00:01:44,070 --> 00:01:51,060 So like I always say that for essays, if the property name and the value are the same, we can write 24 00:01:51,060 --> 00:01:53,760 one which is equally as before. 25 00:01:54,030 --> 00:01:57,540 So now let's check if there is no user. 26 00:01:57,570 --> 00:01:58,160 Okay. 27 00:01:58,440 --> 00:01:59,730 So if. 28 00:02:00,390 --> 00:02:04,170 There is no user found in our database. 29 00:02:04,290 --> 00:02:08,759 It means that this particular user has not been registered yet. 30 00:02:08,759 --> 00:02:12,240 So here we can return from this route. 31 00:02:12,240 --> 00:02:12,890 Here. 32 00:02:13,060 --> 00:02:14,160 Return. 33 00:02:14,160 --> 00:02:17,900 And let's quickly send some message to the user. 34 00:02:17,910 --> 00:02:22,320 For the meantime, let's just send this kind of message as an error. 35 00:02:22,320 --> 00:02:23,610 But it is not. 36 00:02:23,640 --> 00:02:27,730 As we move on, we're going to have a better way to send error messages. 37 00:02:27,750 --> 00:02:29,350 So here we go. 38 00:02:29,400 --> 00:02:34,220 So what we are going to do is that where we can provide a message? 39 00:02:34,230 --> 00:02:38,880 And on that, I'm going to say that user name. 40 00:02:41,830 --> 00:02:43,000 It's not found. 41 00:02:44,670 --> 00:02:50,310 So like I said, if you provide this kind of message, which is is a name is not found, we are giving 42 00:02:50,310 --> 00:02:55,020 more details or hint to any hacker who is trying to log into this application. 43 00:02:55,170 --> 00:02:59,130 So always don't make your message to be more descriptive. 44 00:02:59,130 --> 00:03:06,170 That username is correct, but password is incorrect or password is correct, but username is incorrect. 45 00:03:06,180 --> 00:03:11,550 So always use a message which doesn't seem to be more descriptive. 46 00:03:11,730 --> 00:03:14,760 But for me I always say that invalid. 47 00:03:16,510 --> 00:03:17,870 Login credentials. 48 00:03:17,890 --> 00:03:22,810 In that way, the user might not know whether it is user name or the password. 49 00:03:22,930 --> 00:03:23,560 Great. 50 00:03:23,770 --> 00:03:24,130 All right. 51 00:03:24,130 --> 00:03:28,990 So now at this point, after this point, we assume that there is a user. 52 00:03:29,020 --> 00:03:31,330 Now, here comes the clue. 53 00:03:31,750 --> 00:03:38,110 So step number two is that we are going to check if the password is valid. 54 00:03:38,110 --> 00:03:41,110 So check if password. 55 00:03:42,450 --> 00:03:47,910 Is valid and I'm going to use a method from Decrypt to get the one done. 56 00:03:47,910 --> 00:03:49,260 So let me show you. 57 00:03:49,290 --> 00:03:52,740 So const is password. 58 00:03:54,630 --> 00:03:55,440 Valley. 59 00:03:57,050 --> 00:04:01,460 Is equal to you are going to always be operation. 60 00:04:01,460 --> 00:04:05,450 And the method we have is called the compare. 61 00:04:05,840 --> 00:04:08,180 All right, compare, saying and compare. 62 00:04:08,180 --> 00:04:10,940 If won't use asynchronous way go by this. 63 00:04:10,940 --> 00:04:14,330 But because we are dealing promises let's go by this. 64 00:04:14,600 --> 00:04:16,730 And what are we going to compare? 65 00:04:16,820 --> 00:04:23,960 We are going to compare first is a plane password that is open registration, the password the visa 66 00:04:23,990 --> 00:04:30,470 used, and then the hash password, which is the one inside our database. 67 00:04:30,470 --> 00:04:31,780 And that is all. 68 00:04:31,820 --> 00:04:34,820 So this function returns true or false? 69 00:04:34,820 --> 00:04:41,420 So inside here, let's pass in the password that the plane password from the elected body. 70 00:04:41,750 --> 00:04:47,120 And then inside our DB, we have what is called user dot password. 71 00:04:47,120 --> 00:04:52,450 So you're going to get user found user found dot password. 72 00:04:52,460 --> 00:04:58,280 So here are going to be the user found dot password and that is it. 73 00:04:58,310 --> 00:05:00,560 This method returns true or false. 74 00:05:00,560 --> 00:05:03,440 If it is true, it means that the password is correct. 75 00:05:03,440 --> 00:05:04,730 So here again. 76 00:05:04,940 --> 00:05:06,350 So if. 77 00:05:07,090 --> 00:05:08,020 It is false. 78 00:05:08,020 --> 00:05:13,210 Meaning if there is no password like this one, meaning if password is equal to four. 79 00:05:13,210 --> 00:05:16,870 So this one is same as if password is equal to force. 80 00:05:16,900 --> 00:05:22,000 It is same as so this code is same as this one. 81 00:05:22,000 --> 00:05:22,420 All right. 82 00:05:22,420 --> 00:05:28,480 But normally let's use the inverted way and this will make it cleaner. 83 00:05:28,480 --> 00:05:30,310 Meaning, if it's true, make it false. 84 00:05:30,310 --> 00:05:32,200 If it's false, make it true like that. 85 00:05:32,320 --> 00:05:35,890 So in here we are going to send a message. 86 00:05:35,890 --> 00:05:37,630 Also the same message. 87 00:05:37,630 --> 00:05:40,840 Like I said, don't say that invalid password. 88 00:05:41,080 --> 00:05:43,900 Don't make your message be more descriptive. 89 00:05:43,900 --> 00:05:48,700 So here we assume that the user has been logged in. 90 00:05:48,700 --> 00:05:54,280 So at this point we can go ahead and then redirect the user to the profile page. 91 00:05:54,280 --> 00:05:55,810 So let's see in action. 92 00:05:55,810 --> 00:06:00,760 So back to the page here and now let's refresh it and let's go to log in. 93 00:06:00,760 --> 00:06:06,370 And my username was Emma and password was one, two, three, four, five, let's get sent. 94 00:06:06,640 --> 00:06:14,350 And you can see that where we got the user, but we see that I'm also trying to display the password, 95 00:06:14,350 --> 00:06:15,730 which is not ideal. 96 00:06:15,760 --> 00:06:20,710 So let's go ahead and remove the password from the profile page. 97 00:06:20,710 --> 00:06:23,290 But the good news is that it is working. 98 00:06:23,290 --> 00:06:29,380 So let's remove this line of code from here and now let's refresh it and now welcome. 99 00:06:29,380 --> 00:06:37,030 You can see that my full name and my username and this profile picture is static, meaning irrespective 100 00:06:37,030 --> 00:06:42,670 of who you are, you're going to see this profile image because we have not done what is called file 101 00:06:42,670 --> 00:06:43,690 upload yet. 102 00:06:43,690 --> 00:06:44,920 So that is great. 103 00:06:44,920 --> 00:06:48,010 The good news is that we got it done right. 104 00:06:48,010 --> 00:06:55,030 So what has left is that I want to show you another technique, how we can protect a certain templates. 105 00:06:55,030 --> 00:07:02,500 So for this template, if I click on that, irrespective of being logging in or not, I can still have 106 00:07:02,500 --> 00:07:06,490 access to this and record something session well. 107 00:07:06,490 --> 00:07:12,850 So like I said, for this kind of logging system, everything works fine, but we don't do this one 108 00:07:12,850 --> 00:07:14,350 in real application. 109 00:07:14,350 --> 00:07:20,050 But what you have done so far about the encryption, we are going to use this one a lot. 110 00:07:20,050 --> 00:07:20,740 A lot. 111 00:07:20,740 --> 00:07:23,440 Well, let me show you one more technique here. 112 00:07:23,530 --> 00:07:31,060 Well, let's say that if we haven't log in and you click on this page, we are going to display a message 113 00:07:31,060 --> 00:07:35,170 that log in before accessing this page. 114 00:07:35,170 --> 00:07:40,810 And if the user is log in, we are going to send this kind of message to the user. 115 00:07:40,810 --> 00:07:42,640 So how are you going to do this one? 116 00:07:42,640 --> 00:07:47,440 Well, we need what is called session management because servers are stateless. 117 00:07:47,440 --> 00:07:53,830 So for what we have done so far, well, we are on the right track to implement log in system, but 118 00:07:53,830 --> 00:08:00,550 after logging in our server does not remember who has log in because there is nothing to prove to our 119 00:08:00,550 --> 00:08:03,310 server that I have logging in or you have logging. 120 00:08:03,310 --> 00:08:03,850 Right. 121 00:08:03,850 --> 00:08:06,670 That is why we need what is called session management. 122 00:08:06,670 --> 00:08:09,430 As we move on, we are going to improve this code a little bit. 123 00:08:09,430 --> 00:08:12,580 But let me show you the trick way where we can vote. 124 00:08:12,580 --> 00:08:15,040 Protect this page in this video.