1
00:00:08,290 --> 00:00:09,760
Welcome back.

2
00:00:09,790 --> 00:00:16,630
In this video, let's get started with session based authentication.

3
00:00:17,290 --> 00:00:18,460
All right.

4
00:00:18,520 --> 00:00:22,520
We are going to continue on from the previous video.

5
00:00:22,540 --> 00:00:25,720
That is authentication, using cookies.

6
00:00:26,020 --> 00:00:35,560
So I made a duplicate or a copy of the previous one and I've changed the name to auth cookies session.

7
00:00:35,560 --> 00:00:39,970
Meaning you are going to use cookies and session in combination.

8
00:00:40,090 --> 00:00:45,990
So if I run the application, this is what I have.

9
00:00:46,000 --> 00:00:51,370
So let's see how we are going to implement session based authentication.

10
00:00:51,880 --> 00:00:59,990
So the whole logic is that we are going to configure our server to be able to create session and send

11
00:00:59,990 --> 00:01:02,870
the session to the user called cookies.

12
00:01:02,890 --> 00:01:09,760
So first step is how are we going to configure our application to use session?

13
00:01:10,030 --> 00:01:12,010
So let's get started.

14
00:01:12,160 --> 00:01:18,570
We are going to use a package called Express Session to get it done.

15
00:01:18,580 --> 00:01:25,120
So let's go to our terminal and let's go ahead and install the package.

16
00:01:25,120 --> 00:01:30,040
So let me shut down the server and let me clear the console.

17
00:01:30,070 --> 00:01:36,130
So let's go ahead and install the package and p am I.

18
00:01:37,400 --> 00:01:40,520
Express dash session.

19
00:01:41,350 --> 00:01:49,780
Make sure that you install the exact version as I'm going to install in that way after a year or some

20
00:01:49,780 --> 00:01:51,880
months before watching this video.

21
00:01:51,910 --> 00:02:00,370
Your code would be the same as mine, so going to be version 1.1, 7.3.

22
00:02:00,580 --> 00:02:06,900
So let's hit enter and express search is going to get a job done.

23
00:02:06,910 --> 00:02:08,620
How awesome it is.

24
00:02:08,650 --> 00:02:13,570
Let's clear the terminal and let's start this server again.

25
00:02:13,840 --> 00:02:14,920
All right, Sarah.

26
00:02:14,950 --> 00:02:16,390
Let me collapse you.

27
00:02:16,720 --> 00:02:22,270
The next step is we need to require the package going to be cast.

28
00:02:22,480 --> 00:02:28,510
Session is equal to required express.

29
00:02:29,230 --> 00:02:30,220
Session.

30
00:02:30,400 --> 00:02:31,030
Great.

31
00:02:31,360 --> 00:02:39,640
The next step is we need to configure our server to use expert session and definitely we are going to

32
00:02:39,640 --> 00:02:43,330
configure it using what is called middleware.

33
00:02:43,510 --> 00:02:45,630
Yeah, these are my major words here.

34
00:02:45,640 --> 00:02:48,490
So down here or up here.

35
00:02:48,610 --> 00:02:58,870
Let's go ahead and comment here and say that configure session and you are going to use app dot use

36
00:02:59,020 --> 00:03:04,180
and here you are going to pass in the session you got as a function.

37
00:03:04,330 --> 00:03:11,560
And inside the function call of session, you are going to pass in additional configuration and this

38
00:03:11,560 --> 00:03:13,900
configuration is from the package.

39
00:03:14,140 --> 00:03:22,840
First is we need to provide a secret for signing the cookie and here we can provide any random secret

40
00:03:22,840 --> 00:03:23,590
number.

41
00:03:23,710 --> 00:03:31,330
So if you go to how we can secure express application, we are going to get the key from the environment

42
00:03:31,330 --> 00:03:31,960
variable.

43
00:03:31,990 --> 00:03:35,490
For the meantime, let's maintain it as it is.

44
00:03:35,500 --> 00:03:42,280
Well, so the way we are doing it is that we are going to sign a cookie, meaning a signed cookie.

45
00:03:42,340 --> 00:03:50,560
The previous one we did, we call it as what on sign cookie because there is no key for signing the

46
00:03:50,560 --> 00:03:51,250
cookie.

47
00:03:51,250 --> 00:03:54,160
So that is what this one means.

48
00:03:54,640 --> 00:04:00,700
And the next configuration is safe and let's assign it to true.

49
00:04:00,700 --> 00:04:02,620
So what does this mean?

50
00:04:02,650 --> 00:04:11,320
This is used to save the session if it is not modified, and then the next argument or configuration

51
00:04:11,320 --> 00:04:13,660
is save or initialized.

52
00:04:13,660 --> 00:04:14,860
And what does that mean?

53
00:04:14,860 --> 00:04:16,810
Let's also pull this one to true.

54
00:04:16,839 --> 00:04:23,350
This one means that it is used to save the session if it is not modified also.

55
00:04:23,470 --> 00:04:23,890
Okay.

56
00:04:24,250 --> 00:04:28,660
And then lastly, we need to provide the cookie.

57
00:04:28,660 --> 00:04:31,990
So here you provide cookie, then provide what?

58
00:04:31,990 --> 00:04:36,580
The duration where we want to expire the cookie.

59
00:04:36,580 --> 00:04:40,870
So let's assign to 6000 milli second.

60
00:04:41,870 --> 00:04:48,800
Now that we have finished configuring session, what would be the next step and what benefits?

61
00:04:48,890 --> 00:04:57,040
Benefits number one is that as soon as we finish configuring, we have a property inside our request

62
00:04:57,060 --> 00:04:59,330
called rect session.

63
00:04:59,570 --> 00:05:05,000
And on that object we can add any property onto eight points.

64
00:05:05,030 --> 00:05:13,880
Number two is that as soon as a user visits our page or any of our route, our server is going to generate

65
00:05:13,880 --> 00:05:17,850
what is called cookie and save it into the user's browser.

66
00:05:17,870 --> 00:05:19,190
So let me show you.

67
00:05:19,400 --> 00:05:25,010
Let's open our console and you can see that and storage and cookies.

68
00:05:25,040 --> 00:05:27,980
There is no value inside here.

69
00:05:28,280 --> 00:05:34,790
But as soon as I refresh my page or visit any of this route, let's see what's going to happen.

70
00:05:34,800 --> 00:05:36,260
Put your eyes here.

71
00:05:36,530 --> 00:05:44,570
When I refresh it, you can see that I have some data inside here and we have the cookie name called

72
00:05:44,570 --> 00:05:52,130
Connect Dot as ID as ID simply means session ID and this is the value.

73
00:05:52,160 --> 00:05:59,660
So this is the value our server has given to this particular user and saved it as cookie value.

74
00:05:59,870 --> 00:06:07,580
And you can see that we pass in additional configuration the expiration date for this cookie based on

75
00:06:07,580 --> 00:06:09,110
the explanation.

76
00:06:09,110 --> 00:06:16,760
We saw that as soon as a user logs in or visit our server, our server is going to generate a token

77
00:06:16,760 --> 00:06:20,690
and save into the user's browser, which is this one.

78
00:06:21,110 --> 00:06:26,780
And next is the server is going to save a session, which is this one.

79
00:06:26,780 --> 00:06:32,240
So you may be asking where can you find this session inside our browser?

80
00:06:32,450 --> 00:06:37,820
Well, this session is being saved in the memory of our server.

81
00:06:37,940 --> 00:06:43,060
So any time we shut down our server, this session is going to be lost.

82
00:06:43,070 --> 00:06:49,490
But as you move on, you're going to find a way where you're going to save this one inside our database.

83
00:06:49,490 --> 00:06:53,210
So let's see now you know how it's being generated.

84
00:06:53,360 --> 00:07:01,670
Now, here is the question how can we implement login functionality using this idea core session?

85
00:07:02,060 --> 00:07:10,850
Well, the good news is that we have what is called record session in any of our routes as soon as we

86
00:07:10,850 --> 00:07:14,210
configured our server using session.

87
00:07:14,420 --> 00:07:19,790
So in any of our routes we have a property called Record Session.

88
00:07:19,940 --> 00:07:25,000
So in any of our routes we can console, log, record session.

89
00:07:25,010 --> 00:07:31,190
Let me do it inside this home route, we're going to be rec dot session.

90
00:07:31,370 --> 00:07:35,870
Let's check our terminal here and let's refresh the page.

91
00:07:35,870 --> 00:07:36,830
That's the home page.

92
00:07:36,830 --> 00:07:41,720
And let's see you can see that we have key value per meaning.

93
00:07:41,750 --> 00:07:48,680
This is an object and since it's an object, we can add our own property onto this object.

94
00:07:48,680 --> 00:07:50,570
So let me show you how you're going to do it.

95
00:07:50,570 --> 00:08:00,470
So inside the home route, which is this one, let's have a beautiful command say at log in user.

96
00:08:00,470 --> 00:08:11,300
So here we go, rec dot session dot log in user is going to be the property name and it can be object

97
00:08:11,300 --> 00:08:12,770
or a single value.

98
00:08:12,800 --> 00:08:17,660
Let's provide a single value here as Emmanuel.

99
00:08:18,590 --> 00:08:19,190
Good.

100
00:08:19,220 --> 00:08:28,400
So now if I save this, let me have a look at my terminal here and let's refresh the page and it will

101
00:08:28,400 --> 00:08:33,740
see that we have a property called Logging User and Emmanuel.

102
00:08:33,740 --> 00:08:38,780
So with this concept we can implement log gain functionality.

103
00:08:38,809 --> 00:08:40,150
Pretty simple.

104
00:08:40,159 --> 00:08:48,080
So what we are going to do is that inside our logging route, as soon as a user log in, instead of

105
00:08:48,080 --> 00:08:53,660
just saving the user into cookie, we are going to save the user insertion.

106
00:08:53,900 --> 00:08:57,560
So let's remove this one from here.

107
00:08:57,650 --> 00:09:06,890
And now let's give a few comments that save the log in user into session.

108
00:09:06,890 --> 00:09:10,580
Now we have removed cookie based authentication.

109
00:09:10,580 --> 00:09:12,230
Now here we go.

110
00:09:12,770 --> 00:09:19,550
Rec dot session is equal to user or log in user.

111
00:09:19,940 --> 00:09:26,120
Let's add a property here called log in user and the value can be anything.

112
00:09:26,120 --> 00:09:29,330
It can be a string, boolean array or object.

113
00:09:29,330 --> 00:09:30,980
Let's provide objects.

114
00:09:30,980 --> 00:09:38,870
So let's say that the user name for this particular user is called imaan e manuel as that.

115
00:09:38,870 --> 00:09:40,700
So let's save it and.

116
00:09:41,170 --> 00:09:42,220
Let's check.

117
00:09:42,400 --> 00:09:51,980
So when I go to log in like that, now I have this user in my session and I can console.log that.

118
00:09:52,000 --> 00:09:58,000
So instead of just using static data here, we can get a user and save it into session.

119
00:09:58,240 --> 00:10:02,920
So here we can save the entire user into session.

120
00:10:02,920 --> 00:10:03,970
So here we go.

121
00:10:04,000 --> 00:10:13,150
I'm going to remove this object here and then I'm going to save the found user into session as that

122
00:10:13,150 --> 00:10:13,900
user found.

123
00:10:13,900 --> 00:10:16,000
Sorry, is user found?

124
00:10:16,030 --> 00:10:18,340
So moment of truth.

125
00:10:18,520 --> 00:10:27,880
So if I go ahead and then log in as lazy and one, two, three, four, five, let's hit log in and

126
00:10:27,880 --> 00:10:30,700
let's check our console.

127
00:10:30,820 --> 00:10:37,680
And now we see that I have what is called connect as ID, which is correct.

128
00:10:37,690 --> 00:10:43,160
So in any of our routes, I have access to this log in user.

129
00:10:43,180 --> 00:10:47,640
So let's go ahead in any of our route, for example, the homepage.

130
00:10:47,650 --> 00:10:50,420
Now put your eyes on the terminal here.

131
00:10:50,420 --> 00:10:54,130
And as soon as I go to homepage, let's see.

132
00:10:54,220 --> 00:10:55,720
And there we go.

133
00:10:55,750 --> 00:11:03,760
You can see that we have the log in user and this is a user from our database that is great.

134
00:11:03,850 --> 00:11:11,860
And if you check our console, you can see that we are not saving the user in here, but instead we

135
00:11:11,860 --> 00:11:15,090
are saving just the cookie inside here.

136
00:11:15,100 --> 00:11:16,540
How awesome it is.

137
00:11:16,540 --> 00:11:21,260
It means that we are not exposing the user to the front end.

138
00:11:21,280 --> 00:11:30,250
So one cool thing is that if I try to manipulate or change the cookie ID here, let's save it.

139
00:11:30,250 --> 00:11:32,340
And now let's refresh it.

140
00:11:32,350 --> 00:11:33,850
Put your eyes here.

141
00:11:34,180 --> 00:11:37,530
All right, so let's refresh it and let's see.

142
00:11:37,540 --> 00:11:45,310
And now you can see that there is no user here because this connect ID that is server has sent is not

143
00:11:45,310 --> 00:11:47,800
the same because I have tampered with it.

144
00:11:48,040 --> 00:11:51,910
That is why I'm not able to see the login user.

145
00:11:52,180 --> 00:11:59,830
But if I refresh again or log in again, I'll be able to see the log in user.

146
00:11:59,860 --> 00:12:01,300
So let's go ahead and do that.

147
00:12:01,300 --> 00:12:11,080
So now as soon as I log in as lazy and one, two, three, four, five, let's see now I've gotten a

148
00:12:11,080 --> 00:12:17,650
new cookie here and if I check my terminal here, let's go to homepage.

149
00:12:17,650 --> 00:12:22,330
And now you can see that I have the log in user.

150
00:12:22,360 --> 00:12:26,640
So this is how we can use to implement log in functionality.

151
00:12:26,650 --> 00:12:33,640
So in the next video, let's go ahead and create a murderer to protect any route.

152
00:12:33,640 --> 00:12:40,480
For example, if you want to visit, let's say profile page, unless you look in or if you want to go

153
00:12:40,480 --> 00:12:46,090
to, let's say, any route that you want to protect, we are going to use that malware to check if a

154
00:12:46,090 --> 00:12:47,740
user has logged in or not.