Welcome back.
In this video, let's see how we can protect a root from unauthorized user, meaning that if a user
is not logged in, we need to send a message that please log in or you are not authorized.
So as it stands right now, we have logged in successfully, but like I said, since HTTP are stateless,
our server does not know who has log in.
To achieve that.
We are going to create a murderer always to check if a user or there is a token in the browser or in
the header.
And then it will take that token and compare to the one that has been saved on a server.
So let's see how you're going to create that one.
Well, we can make it as universal, meaning that we are going to protect our route.
Let's move in that way, and then we can refer to it to protect a specific route.
So let's come up here before our route here and let's call this one off media where as that and we can
get that one done using app dot use.
We have access to wreck response and then next and for this one too, we have covered in detail in the
previous session.
So for this one, if I log rec dot session, let's have a look and let me run the server again.
Good.
So now in any of the route, if I go to homepage and you can see that we got the session being what
console.
Look here.
So what we are going to do is that this middleware is going to check if there is a log in user and if
there is no log in user, we want to display a certain template.
So let's create one templates and call this one off or not allowed.
So this template is just going to displace a message to the user that you need to log in.
Okay, so let's go ahead and do that one.
So here we go.
Let's add H one and it says that you.
Let's say unauthorized.
Simple message.
As that.
And let's add some P tag here with some dummy text.
So we want to display this template.
If a user is not log in and he or she is trying to access a protected route, so now we can go ahead
and then do that.
So inside our middleware, this one, let's make a condition and says that if there is no rec dot session.
Dot log in.
User, then we want to.
Render, rest, render, and then we render the not allowed templates going to be not allowed.
Templates are?
Is that so with this one, let's check it out.
So inside our page, let's refresh the page and you can see that on authorized meaning that I have not
log in in any of the route I visit, I will see this template called on authorize.
So how can I look in?
So this idea is not all that good.
So let's go ahead and then refactor this middleware and then we are going to pass into any route of
which we want to protect.
So here we go.
So let's catch the callback function from this as that.
And next is let's create our own middleware less name this middleware as protected, which is equal
to our callback function.
We copy it, so that is it.
The next step is we need to call next, otherwise it will keep hanging again.
We have covered this one in details.
So any route that I want to protect, I'm going to pass in this protected middleware.
So now if I refresh the page, you can see that now I get back my form, I can go to any page because
I'm not using the protected network.
So now let's try to protect the profile page, which is down here, register and profile page.
Now I want to protect the profile page as a second element to this function called good profile.
And I also want to protect the protected route, which is this one.
I also want to protect that as that good comma separated.
Perfect.
So now on this template core protected, I don't need to check or make any conditions here, so I want
to remove this one from the previous video.
I don't want to make any condition.
I just want to say that welcome to your protected page.
Let's say bravo.
Hey, hey, hey.
All right, so now let's have a look.
If I go to the page now, if I refresh it and go to home, I go to log in, I can navigate.
But as soon as I click on Protected where something is not working well.
So let's check the terminal and see where I went wrong.
There is something wrong here.
It says that it cannot send headers after it has been sent.
Well, I got it.
The problem must be from our middleware function here.
Let me collapse this one little bit and let's locate our middleware function, which is this one we
need to return.
Yes.
From this middleware function.
All right.
So now let's check it out.
And the server has restarted and let's refresh it.
Let's go to home.
Home page is working, login is working, register and protected.
And we have the unauthorized page, meaning you need to log in and we can add a button down here to
go to log in.
So let's do that one quickly.
So inside the not authorized page, let's add this one.
Let's add.
A link and cord is one.
Log in the path and log in.
So let's see.
Let's refresh it.
And now I see.
Log in.
Let me click on that and go to.
Look in here.
One, two, three, four, five.
And look in.
Now, I have looked in.
That is it.
If I go to protect it.
Now, welcome to your protected.
But, guys, one caveat then.
As soon as I restart my server.
Let's see what's going to happen when I refresh it.
If we see that not authorized, that is why we make mention that.
Let's go to point number five.
Yeah, last point here.
It says that when a user logs out or the server destroys the search in the cookies and indeed that is
why it has been declared.
So we need a way to pass this the session and we'll get into that in the next video or the upcoming
ones.
The next video.
Let's implement how we can log out a user.