1 00:00:07,950 --> 00:00:19,350 Welcome to the last type of authentication system, and that is token based authentication or using 2 00:00:19,350 --> 00:00:26,460 what is called JSON web token, that is JWT for shops. 3 00:00:26,820 --> 00:00:32,340 And this kind of authentication is mostly used and it's modern. 4 00:00:32,520 --> 00:00:40,350 So if you want to build a real world application by implementing authentication, then I advise you 5 00:00:40,350 --> 00:00:45,090 to use what is called token based authentication. 6 00:00:45,390 --> 00:00:54,150 And for my client projects, this is the type of authentication that I use because it is secured and 7 00:00:54,150 --> 00:00:54,960 modern. 8 00:00:54,960 --> 00:00:58,380 So what is token based authentication? 9 00:00:58,380 --> 00:01:05,220 Well, explaining this is somehow difficult than showing you in a code. 10 00:01:05,220 --> 00:01:12,780 So most instructors find it difficult to explain in details how the token based authentication work 11 00:01:12,810 --> 00:01:14,280 using diagrams. 12 00:01:14,280 --> 00:01:22,680 So in this video, I tried my best to make it pretty simple by taking you through the process of using 13 00:01:22,710 --> 00:01:24,810 token based authentication. 14 00:01:24,810 --> 00:01:26,850 So let's get started. 15 00:01:27,150 --> 00:01:33,450 Do you remember this diagram when we're talking about session based authentication, but we are going 16 00:01:33,450 --> 00:01:36,930 to change some terms and processes in the mix. 17 00:01:37,110 --> 00:01:46,080 So as always, let's say that we already have the registered user and this user is trying to log in 18 00:01:46,080 --> 00:01:47,820 into our application. 19 00:01:47,820 --> 00:01:51,240 So the first step is we need the server. 20 00:01:51,630 --> 00:01:59,760 So as soon as a user makes a request, then the details will send to the server and the server will 21 00:01:59,760 --> 00:02:04,110 make a request to database to check if there is a user. 22 00:02:04,380 --> 00:02:14,250 So if there is a user, then inside our server we are going to incorporate what is called JWT package. 23 00:02:14,250 --> 00:02:23,850 So inside our server then this function is going to generate what is called token and then send it to 24 00:02:23,850 --> 00:02:30,060 the user's browser and save it into what is called the cost storage. 25 00:02:30,180 --> 00:02:39,120 So this is the flow one more time when a user logs in successfully, then our server is going to talk 26 00:02:39,120 --> 00:02:48,390 to this package called JWT and then this package is going to generate a token and then save it into 27 00:02:48,390 --> 00:02:50,490 the user's browser. 28 00:02:50,790 --> 00:02:59,490 So upon every request, the user need to send the same token as part of the header. 29 00:02:59,490 --> 00:03:08,850 And then when it gets to our server, it is the responsibility of the JWT to verify the token. 30 00:03:08,970 --> 00:03:16,620 So before it verified, as soon as the token is generated, let's see what goes on here. 31 00:03:16,890 --> 00:03:22,790 This package is going to take an identifier from the user. 32 00:03:22,920 --> 00:03:32,820 We can sign the token with a person, email or ID or full name whatever, so that identity will be inside 33 00:03:32,820 --> 00:03:34,800 the token generated. 34 00:03:35,010 --> 00:03:45,570 So upon every request, our browser is going to send the token as a header and then the package is going 35 00:03:45,570 --> 00:03:49,920 to verify the token called decoded. 36 00:03:49,950 --> 00:03:53,070 So what is the code that can verify? 37 00:03:53,070 --> 00:04:00,570 We are going to see the login user that was used to sign in the token. 38 00:04:00,570 --> 00:04:05,280 So that is the basic flow of the JSON web token. 39 00:04:05,280 --> 00:04:13,290 So in case somebody tampered with the token, then it's going to reject and says that token expired 40 00:04:13,290 --> 00:04:15,120 or invalid token. 41 00:04:15,120 --> 00:04:17,880 And if everything is correct, why not? 42 00:04:17,910 --> 00:04:26,100 I'm going to give you the go ahead to use the application because now the token has been verified. 43 00:04:26,100 --> 00:04:34,200 So with this one being in mind, the next video, let's get started with how we can implement the token 44 00:04:34,200 --> 00:04:38,340 based authentication by moving step by step.