Welcome back.
In this video, let's get started with session based authentication.
All right.
We are going to continue on from the previous video.
That is authentication, using cookies.
So I made a duplicate or a copy of the previous one and I've changed the name to auth cookies session.
Meaning you are going to use cookies and session in combination.
So if I run the application, this is what I have.
So let's see how we are going to implement session based authentication.
So the whole logic is that we are going to configure our server to be able to create session and send
the session to the user called cookies.
So first step is how are we going to configure our application to use session?
So let's get started.
We are going to use a package called Express Session to get it done.
So let's go to our terminal and let's go ahead and install the package.
So let me shut down the server and let me clear the console.
So let's go ahead and install the package and p am I.
Express dash session.
Make sure that you install the exact version as I'm going to install in that way after a year or some
months before watching this video.
Your code would be the same as mine, so going to be version 1.1, 7.3.
So let's hit enter and express search is going to get a job done.
How awesome it is.
Let's clear the terminal and let's start this server again.
All right, Sarah.
Let me collapse you.
The next step is we need to require the package going to be cast.
Session is equal to required express.
Session.
Great.
The next step is we need to configure our server to use expert session and definitely we are going to
configure it using what is called middleware.
Yeah, these are my major words here.
So down here or up here.
Let's go ahead and comment here and say that configure session and you are going to use app dot use
and here you are going to pass in the session you got as a function.
And inside the function call of session, you are going to pass in additional configuration and this
configuration is from the package.
First is we need to provide a secret for signing the cookie and here we can provide any random secret
number.
So if you go to how we can secure express application, we are going to get the key from the environment
variable.
For the meantime, let's maintain it as it is.
Well, so the way we are doing it is that we are going to sign a cookie, meaning a signed cookie.
The previous one we did, we call it as what on sign cookie because there is no key for signing the
cookie.
So that is what this one means.
And the next configuration is safe and let's assign it to true.
So what does this mean?
This is used to save the session if it is not modified, and then the next argument or configuration
is save or initialized.
And what does that mean?
Let's also pull this one to true.
This one means that it is used to save the session if it is not modified also.
Okay.
And then lastly, we need to provide the cookie.
So here you provide cookie, then provide what?
The duration where we want to expire the cookie.
So let's assign to 6000 milli second.
Now that we have finished configuring session, what would be the next step and what benefits?
Benefits number one is that as soon as we finish configuring, we have a property inside our request
called rect session.
And on that object we can add any property onto eight points.
Number two is that as soon as a user visits our page or any of our route, our server is going to generate
what is called cookie and save it into the user's browser.
So let me show you.
Let's open our console and you can see that and storage and cookies.
There is no value inside here.
But as soon as I refresh my page or visit any of this route, let's see what's going to happen.
Put your eyes here.
When I refresh it, you can see that I have some data inside here and we have the cookie name called
Connect Dot as ID as ID simply means session ID and this is the value.
So this is the value our server has given to this particular user and saved it as cookie value.
And you can see that we pass in additional configuration the expiration date for this cookie based on
the explanation.
We saw that as soon as a user logs in or visit our server, our server is going to generate a token
and save into the user's browser, which is this one.
And next is the server is going to save a session, which is this one.
So you may be asking where can you find this session inside our browser?
Well, this session is being saved in the memory of our server.
So any time we shut down our server, this session is going to be lost.
But as you move on, you're going to find a way where you're going to save this one inside our database.
So let's see now you know how it's being generated.
Now, here is the question how can we implement login functionality using this idea core session?
Well, the good news is that we have what is called record session in any of our routes as soon as we
configured our server using session.
So in any of our routes we have a property called Record Session.
So in any of our routes we can console, log, record session.
Let me do it inside this home route, we're going to be rec dot session.
Let's check our terminal here and let's refresh the page.
That's the home page.
And let's see you can see that we have key value per meaning.
This is an object and since it's an object, we can add our own property onto this object.
So let me show you how you're going to do it.
So inside the home route, which is this one, let's have a beautiful command say at log in user.
So here we go, rec dot session dot log in user is going to be the property name and it can be object
or a single value.
Let's provide a single value here as Emmanuel.
Good.
So now if I save this, let me have a look at my terminal here and let's refresh the page and it will
see that we have a property called Logging User and Emmanuel.
So with this concept we can implement log gain functionality.
Pretty simple.
So what we are going to do is that inside our logging route, as soon as a user log in, instead of
just saving the user into cookie, we are going to save the user insertion.
So let's remove this one from here.
And now let's give a few comments that save the log in user into session.
Now we have removed cookie based authentication.
Now here we go.
Rec dot session is equal to user or log in user.
Let's add a property here called log in user and the value can be anything.
It can be a string, boolean array or object.
Let's provide objects.
So let's say that the user name for this particular user is called imaan e manuel as that.
So let's save it and.
Let's check.
So when I go to log in like that, now I have this user in my session and I can console.log that.
So instead of just using static data here, we can get a user and save it into session.
So here we can save the entire user into session.
So here we go.
I'm going to remove this object here and then I'm going to save the found user into session as that
user found.
Sorry, is user found?
So moment of truth.
So if I go ahead and then log in as lazy and one, two, three, four, five, let's hit log in and
let's check our console.
And now we see that I have what is called connect as ID, which is correct.
So in any of our routes, I have access to this log in user.
So let's go ahead in any of our route, for example, the homepage.
Now put your eyes on the terminal here.
And as soon as I go to homepage, let's see.
And there we go.
You can see that we have the log in user and this is a user from our database that is great.
And if you check our console, you can see that we are not saving the user in here, but instead we
are saving just the cookie inside here.
How awesome it is.
It means that we are not exposing the user to the front end.
So one cool thing is that if I try to manipulate or change the cookie ID here, let's save it.
And now let's refresh it.
Put your eyes here.
All right, so let's refresh it and let's see.
And now you can see that there is no user here because this connect ID that is server has sent is not
the same because I have tampered with it.
That is why I'm not able to see the login user.
But if I refresh again or log in again, I'll be able to see the log in user.
So let's go ahead and do that.
So now as soon as I log in as lazy and one, two, three, four, five, let's see now I've gotten a
new cookie here and if I check my terminal here, let's go to homepage.
And now you can see that I have the log in user.
So this is how we can use to implement log in functionality.
So in the next video, let's go ahead and create a murderer to protect any route.
For example, if you want to visit, let's say profile page, unless you look in or if you want to go
to, let's say, any route that you want to protect, we are going to use that malware to check if a
user has logged in or not.