1
00:00:07,780 --> 00:00:16,630
Let's finish up the cookie based authentication by implementing what is called login out a user and

2
00:00:16,630 --> 00:00:20,980
you will learn how we can secure our cookies also.

3
00:00:21,010 --> 00:00:22,550
So let's see.

4
00:00:22,570 --> 00:00:24,490
So back to our file.

5
00:00:24,520 --> 00:00:31,210
This is a route that you are going to use to play around with the configuration of our cookies.

6
00:00:31,300 --> 00:00:37,030
So when I hit this route called Send Cookies, I'm going to set this cookie by name, John.

7
00:00:37,030 --> 00:00:38,470
So let's have a look.

8
00:00:38,500 --> 00:00:41,350
So for us, large signed cookies.

9
00:00:41,380 --> 00:00:45,010
And when I check my console here.

10
00:00:46,070 --> 00:00:49,430
And under application and cookies.

11
00:00:49,430 --> 00:00:56,990
You can see that I have the name here and for this one I can change the name, whatever I want.

12
00:00:56,990 --> 00:01:00,280
And that is why cookies are not all that secured.

13
00:01:00,290 --> 00:01:08,210
And again, I can access the cookies using JavaScript that is making use of documents dot cookie and

14
00:01:08,230 --> 00:01:10,280
cookie that I have the name here.

15
00:01:10,490 --> 00:01:17,750
So if you want avoid using JavaScript to access our cookies, we are going to pass in additional configuration

16
00:01:17,750 --> 00:01:19,070
to the cookie.

17
00:01:19,070 --> 00:01:23,420
So the third segment is going to be our configuration option.

18
00:01:23,420 --> 00:01:29,540
So here the first property is HTTP only and let's say to true.

19
00:01:29,540 --> 00:01:30,830
So what does it mean?

20
00:01:31,130 --> 00:01:39,050
This one means that cookies is only accessible through the server, meaning it cannot be accessed by

21
00:01:39,050 --> 00:01:41,060
the client side JavaScript.

22
00:01:41,060 --> 00:01:45,560
So if you make use of document or cookie, it will not work.

23
00:01:45,560 --> 00:01:53,030
So now let's save it and let's refresh the application and let's go to the application tab and now I

24
00:01:53,030 --> 00:01:55,520
have it here, so let's remove it.

25
00:01:55,520 --> 00:01:59,150
And this time around let's refresh it and set new cookies.

26
00:01:59,150 --> 00:02:06,650
And now you can see that under this tab we have HTTP only and we have the check mark.

27
00:02:06,650 --> 00:02:14,660
So if I go to the console by using JavaScript to access it, we see that we have empty string, meaning

28
00:02:14,660 --> 00:02:19,580
that I cannot have access to my cookie using JavaScript.

29
00:02:19,760 --> 00:02:24,800
Then next key value you need to pass in is called the secured.

30
00:02:25,070 --> 00:02:28,520
Secured is set to true.

31
00:02:28,520 --> 00:02:29,720
So what does it mean?

32
00:02:29,750 --> 00:02:35,420
It means that this cookie is only accessible through https.

33
00:02:35,420 --> 00:02:40,910
And lastly is we can provide the expiration of the cookies.

34
00:02:40,910 --> 00:02:47,360
We can say that after seven days or one day we won't remove the cookies, so how can we get the one

35
00:02:47,360 --> 00:02:47,960
done?

36
00:02:47,960 --> 00:02:51,530
So back to the configuration list, how are we going to do it?

37
00:02:51,560 --> 00:02:59,840
We pass in what is called maximum edge, and for this one, if we want to have seven days, is going

38
00:02:59,840 --> 00:03:02,930
to be 1000 milliseconds.

39
00:03:03,110 --> 00:03:08,180
Times 60 seconds, times 24.

40
00:03:08,880 --> 00:03:14,150
And then times seven, this one means, what, seven days?

41
00:03:14,160 --> 00:03:19,170
So if we want to expire this one within seven days, this is the syntax.

42
00:03:19,230 --> 00:03:24,860
And if we want to expire the cookie for one second, I'm going to remove this one.

43
00:03:24,870 --> 00:03:30,650
It's going to be the one second, but let's maintain the seven days.

44
00:03:30,660 --> 00:03:37,710
So this is a clue where we need to add additional 16 as that well.

45
00:03:37,710 --> 00:03:38,340
So that is it.

46
00:03:38,340 --> 00:03:45,600
So let's go ahead and then refresh it and then let's remove the cookie and try to send again.

47
00:03:45,600 --> 00:03:46,830
And this time I run it.

48
00:03:46,830 --> 00:03:49,230
We see that we have expiration.

49
00:03:49,260 --> 00:03:53,280
It's going to expire 2022 at this time.

50
00:03:53,280 --> 00:03:56,370
So that's how you can secure our cookies.

51
00:03:56,490 --> 00:04:02,220
So the next video, let's go ahead and implement what is called logging out.