Welcome back.
In this video, let's see how we can protect a route by implementing what is called middleware.
So back to the code and inside the server.
Before we get into that, let's try to refactor this code over here because we may need this code that
is getting the token from the header in any route that we want to have access to the user.
So let's go ahead and create one for the core middleware.
And it's going to have our middleware, for example, is logging or is an admin and many more.
So for the meantime, let's work with a log in.
So here is going to be a log in dot JS.
Good.
And remember because it's a memory you need to take in three agreement that is the.
Requests and then response.
So let's go ahead and do that.
Cost is locked in equal to my function req response and next as that let's look at the roadmap here.
Step number one is get the token from header.
Then step number two is we want to verify the token.
And if everything goes on, well, we need to save.
Step number three is.
Save the user into rec into rec object before we move on.
This kind of authentication using token is mostly used in stock application because for this one we
are dealing with words e.g. template that is HTML.
And if we want to have a complete application using this approach, we need to write a lot of code.
So I will show you what I mean as you move on.
So let's finish up this one.
So how can we get the token from a header?
What is inside this root?
So it means that we can extract this one and then put it inside a different folder called Utils.
So let's create one folder called utility function folder.
And the first function that we are going to create is called Get.
Tolkien from header.
The name is too long, but don't worry.
So let's see how you're going to create that functionality.
Well, it means that this function is going to take in the request object because this is what we are
accessing here.
Well, the responsibility of this function is to receive the entire request object, and then it is
going to take the token from the header.
So we are going to cut the logic inside this profile because this code takes in the token.
So our cut everything from here and next is our paste in here.
So before I do that, let me go back here.
Before I do that, let's try to console.log the request object.
In that way, you better understand the method that we are going to grab on that.
So let's go ahead and then require the method called get to kin from header and I have the auto import
start.
So next is inside any route where I want to have access to the request object, I'm going to pass in
that function.
So let's truncate the profile route.
Which is this one.
So let's go ahead and assign to a variable call.
My, my token is equal to get token from a header, then you pass in the request object.
So now I can remove that because I'm console.log init from this function.
So now let's go ahead and make the requests and now let's check our terminal and you can see that we
have the header and this is what we want.
You can see we have the properties and the authorization key is what we want.
Now we have accessed the request object inside this get token from header.
So now it's time for us to cut everything from here as that and let me remove this function for now.
Let me maintain it.
And now back here, last place it here.
So now let's check if there is no token or if token is not equal to undefined, it means that there
is token.
So what are we supposed to do?
If there is token, why not?
We go ahead and then return the token.
Otherwise we are going to return.
And objects with some messages on that by providing status, let's say, failed.
And the message we're going to be as.
Good.
So now let's see.
Let's go ahead and use the function.
Now we are using it here.
So let me call this one and this function.
Now, moment of truth.
So if I go to the profile and make the request, well, I get something.
Where?
Here, meaning talking is not defined.
So it means that we are not assigning the result coming back from this function as token.
So it's equal to that.
So let's go ahead and make the request again.
And now you see that everything remains the same.
But if I turn off the authorization or even the value here from this, let's see, let's see the response
we're going to get now, meaning there is no token attached to that because at this point we pass in
to the verification.
So now it is working.
So let's also move this function to it on file.
So which is this function called verification?
So let's go ahead and create a file to put this code on it.
So let me cut it from here and let me go to the utils here and here we go.
Going to be verified token, see how we are breaking down the concept and now let me paste it here.
So let me export this function as module dot exports equal to verify token.
So now inside the server file, let's go ahead and require the function called verify token.
So here you go.
So in any route that I want to verify, I'm going to use that function.
So I want to verify here as that.
Now we have it as before, so let's go ahead and make the request.
Well, I get something wrong.
Let's see.
JWT is not defined simply.
Is that on this file?
We are making use of this module but is nowhere to be found.
So let's go ahead and then require that package as JWT equal to required and then the function as JSON
web token.
Now let's see if everything is correct and we got NARA simply because in the header we are not passing
in the bearer.
So here we can also check some condition that if there is no header here, we can display error.
For the meantime, let's bring back the token and let's see we got now.
So let's log in again and get back.
Sorry, this log in here is that log in root.
So let's hit send.
I have the token and let me and the profile.
Let me change this one to the entire token here.
And you can see that we go back the user and everything remains the same.
So this is how we are able to refactor it.
Well, the main concept that you want to do is we want to create a root for checking a log in.
So let's continue the next video to finish up this logic, because right now we are almost through because
we have these functions being on different file so we can go ahead and use it inside this module in
the next video.