Welcome back.
Let's get started with Jason Webb talking.
So I have made a copy to the previous project and I have renamed this one to JWT.
So let's do some housekeeping for this particular implementation.
We don't need session or quickie parser or whatever.
So let's go ahead and remove these two packages, session and Mongo store.
So go away.
And we need the connection string for logging in and we need the user model as that.
And we don't need the session configuration because we are going to use JWT and these functions are
for seven status file.
So let's maintain them and let's reduce the gaps as that and let's go down this one to we need it to
receive incoming data and cookies.
Two, we don't need this ones this route, we don't need it.
Remove that and we don't need the merged.
Well, for now let's go to remove that and inside the home root, let's remove the session like that.
And then for logging out to let's remove the logic inside that and log in, maintain it for just displaying
the template.
Let's remove this middleware because we have remove it and for log in everything is correct.
So let's collapse it now for the log out too.
Let's also remove this comment here because using this approach is really awesome.
So we need to have more room to play around with it.
And for the registration to after registration, we don't need to save the user into cookies like this
one.
So let's also remove that.
And yeah, I think profile is okay.
Yes.
So now everything is okay.
Now let's work with the logging in functionality and after logging in we won't generate the token.
So let's see how it's going to work.
So based on the diagram, when a user logs in, we are going to generate a token.
So let's start from here.
How we can generate a token and you are going to use a package called JWT.
Let's look at the description about JSON Web token.
It says that JSON Web tokens are open industry standard are FC 9519 method for representing claims securely
between two parties.
So it allows you to decode and then verify and generate JWT.
So let me show you with code to better understand this description.
So all what is doing here is that when we generate the token, we call it as encoded.
And then if you want to get back the details about the token or the user that was used to generate this
token, we are going to use what is called decoded and we come back here as you move on, if you click
on libraries, you can see the languages that can be used with this package and we can use Node.js for
it.
So we are lucky to go.
So let's go ahead and then install this particular package.
So let's go to our terminal here and let's shut down the server.
All right, so I think there's something wrong.
Yeah, so don't worry.
We'll fix it very soon.
Let's clear the terminal here as that and let's install the package call JSON Web token.
So here we go.
And p m, I install JSON Web token and make sure that you install the exact version 8.5.1 hit enter
and Jason web token is installing let's have some patience and some minute it will finish.
So why it is installing.
Let's go ahead.
Oh, I think it has finished.
So let's try and then restart our server and here we go.
Oh, we got some error.
Code protected is not defined.
It means that we need to remove that.
Where is it protected?
I think we are using it in some places.
So let's remove this comment here and protect.
Yeah.
This one.
Okay, you got it.
So remove that.
Okay, so now these are all empty root.
So let's go ahead and then configure it.
So the first step is we need to require the package.
Const JWT is equal to Jason Web token and this kind of authentication is mostly used in stock projects,
so pay attention to it.
So how are we going to generate let's move slowly and step by step.
Let's start with the how we can generate the token.
So let's go ahead and then create the function.
So here we go before our roots.
Here, let's work.
Let's work with the JSON web token that is JWT for short.
So the first method that we are going to create is called generate token.
Generate Turkey.
And here we go.
Cost.
Generate.
Tolkien.
Is equal to.
I realize that this function is going to return the generated token.
So let's assign a variable called token which is equal to the package which is JWT.
So let's bring it here.
JWT.
Dot sign.
Meaning we are going to sign a token and then assign to this variable called token.
So here we need a payload or let's say a payload, the in user that we want to sign the token and give
it to.
So this is what we are referring to.
Right.
You want to take a data, a payload?
It can be ID, it can be the user name.
And that's what you call the payload.
And that is what this function takes.
So this function you pass in the user and here you pass it as an object, as user.
The first argument.
The second element is a secret key.
So here we can save this one inside environment variable.
But for the meantime, let's just type in in a key here.
All right.
And next is the next agreement going to be some configuration, the X files in meaning?
At what time do we want to expire this particular token?
So let's say that after one hour we need to log in back.
So one hour as that.
So the next step is let's go ahead and then return from this function.
And that is the token as that.
And I kind of shorten this one by immediately return it from here in the same as before.
JWT So here, let's go ahead and call the.
Function call took in.
And is equal to generate talking.
And remember, we are going to pass in the user that we want to assign this Tolkien to.
So here we pass in an object with the user name say.
Emmanuel.
And then the email.
It's going to be at any at gmail.com.
All right, so here we go now, and let's save it now.
As soon as we run the server, we are going to see generated token.
So let's go ahead and then console.log the token and let's see.
So let me open the terminal here and as soon as it's refreshed, see that we have the token being what
generated for this particular user.
So now we are done with the first step called generate token, which is this one.
So now in the front end, we need to save this token at the front end.
But for the meantime, let's work on the back end because it's really important skills to understand
how we can make use of JSON web token.
So now we say that as soon as the token is generated, then upon every request, the browser need to
send the token as part of the request.
And then this package is going to verify called decoding.
And after decoding we are going to see the payload of this user, which was the username and then the
email.
So now with this one, let's try to decode it using the JWT see to.
So now let's copy that and let's go to JWT website and let's go to the home page and let's have a look
at this.
We see that here is our encoded token.
Now we are going to replace this one with our token that we have copied and down here is going to decode.
After decoding, we are going to see the payload, meaning the user which was used to sign this token.
So as soon as I paste this token and you will see that I have the user here, that is awesome, guys.
So now we're able to decode this token and get back the user.
So with this one being in mind, what you can do is that after a user is logged in, we are going to
verify the token called decoded and save this user into the request object and that is it.
If I tamper with the token, you see that there is no payload because the user which was used to send
this token is not this token, meaning it has been tampered.
Did you get it?
Yes.
So now with this one, what we can do is that we need to generate the token upon logging in.
So now instead of just console log, something like this one, what we are going to do is that after
logging in, let's locate the log in root, which is this.
So after logging in here, we are not going to save the user into session, but instead we are going
to add a took him to the user.
For the meantime, let's work on the back end.
So here we go.
So let's remove this one from here and even less common this one.
And now let's work on the back end, like I said.
So here, let's return rest Jason and let's send the details.
So we don't want to send the entire user, for example, the ID, or we can send some specific part
of the user.
So let's say that I want to send the username and it can be found and the user found dot the user name
as that and then the foo name as that.
We can also get it from the user found dot foo name and we want to add a property called Token.
All right, so here, how can we get it?
Well, this is a function.
So here we can call this function down here and then we pass in the user details as that.
So we are passing the entire user for the sign in the token.
But ideally we often use the ID of the user.
But for the meantime, let's just sign the entire user with the token.
So now save it.
Let's go to Postman or better.
We can use this to call ten clients and let's create one collection.
We have it already.
And this is for logging in.
Do you remember?
Yes.
Good.
Now, as soon as I look in, remember, this user doesn't exist.
But let's try.
If I look in, let's see that I got invalid login credentials.
So let's use because this user exists and the password remains the same.
So let's send and we got something incredible.
You see, we got the user name and then full name and additional property called Token.
So on the front end we are going to save this token into local storage.
Well, now that we have log in successfully with a token, what we are going to do is that upon every
request we want the user to send this to a loan, meaning that we are going to put some root on less
a user pass in the token as part of the header request.
Then we are going to take this token and then verify it.
So in the next video, let's see how we can verify this token.