Welcome back.
Let's finish up the slogan media world.
So let's start from scratch by opening the files.
So what we want to do is that for this route or any route that we want to protect, we are going to
create a murderer called a log in.
So the responsibility for this function is always to hit the server to check if a user is logged in.
So these are the steps.
So this function is going to ward, get the token from the header and then verify it.
And lucky for us, we have all this function being ready for us to use.
So if you want, we can copy this code here and then inside for the login.
That's the first step here.
We put it here and then the next step is the verification to you.
Copy this one.
And then we also put it here.
As you can see that we have both lines of code here, which is not ideal.
That is why I have separation of consent by putting them on separate file.
So what I need first is to get the token from header and I have this function that is it.
So here, let's go ahead and then required get token from header.
And step number two is to get the verification token function, which is this one also.
So let's go ahead and do that.
So verify token, I also have the auto import.
That is crazy, guys.
So now that we have it, the next step is let's use those functions.
So here we go.
A token from get token from header start.
And next point, let me assign to a variable called token equal to that.
And when I get a token, I want to verify it.
So here are going to be the verify token and I'll pass in the token as that.
If you have taken some of my master courses or projects, you see that I write everything inside one
file, but this time around I have mixed some separation of can send.
So here we get back the decoded user equal to that.
And next is let's save the user before saving the user.
We need to call next.
But before that, let's check.
So if before we save the user here, let's check if there is user in that.
So if there is no decoded meaning that if there is no user, then we are going to return from this module
and send some message that.
Invalid token place locked in.
So here, let's provide a property called message.
Can I be as invalid Tolkien or invalid or expired Tolkien?
Something like this one.
And then let's say please log in again.
All right.
And if there is user, then you go ahead and call next.
So down here, we are going to call next.
Before we call next, we need to save the user.
But for the meantime, let me show you what I mean first, and then we'll go ahead and save the user
into the request object.
So module dot x export and is equal to is logged in.
So in any route that I want to protect, I'm going to use this record is logged in.
So back to my server file where we have all the logic less required.
A log in middleware which is down here.
Next is in any route that I want to have access to the user, then I will pass it as a second argument
to the function.
Or if I want to protect any route, I'm going to use app dot use.
But this is not the idea.
But let me show you what I mean here.
Let's try out and see if everything is working.
So let's go ahead and then try the profile route and see where we got some cannot read property of undefined.
So what is the problem?
Let's check the terminal here and let's look at the error message.
The same thing cannot read properties of undefined core headers.
So what is this problem?
Well, the problem can be that we are not passing in the request object.
That is why it says that it cannot read the headers on the request object.
So let's get back to the east log n o better mine side.
Remember this function.
Accept the entire request object so I'll pass in here as request object.
So now let's try again and let's send a I got status 200 meaning everything is okay and the time it
took to finish the request.
And if I check there is passed.
Here we go.
I get back the file.
So if I try to tamper with this code and let's see if we see that word come to your profile, then I
got no meaning undefined.
So we need to check it well inside here because this function is not being called.
So let's try to console that log the decoded user when the token is not valid.
So let's try again and let's check the terminal and see if I'm going to get you see that we got the
response, which is this.
So why is that?
We are not getting this invalid token.
So the problem is that we are returning an object and since there is value on the object, it is always
true.
That is why this one is not able to run.
So what we need to configure is the verify token.
Instead of just returning the message down here, we are going to return false or in the status we can
say failed or false.
But to make it more simple here, let's go to the verification token.
And if everything is not correct, then we are not going to return object like this, but instead forks
with this one.
This line of code is going to run because this one is false.
So now let's see, let's send again.
And here we go.
Message invalid x pi token.
Please log in again.
Don't worry about it.
That is cool because we are not handling the errors gracefully, but the logic is that our middleware
function is working nice.
But if I bring back the token well and we see that I get my token.
So this how we implement what is called JSON web to.
Well, if you're thinking, how can we work on the browser or the client side?
So like I said, for this kind of authentication, if you want to incorporate into such application,
unless you write a little code.
So if you want to give yourself a challenge, let me show you how you're going to do so inside the login
route.
When we register, we want to take the token and save into local storage, and then upon every request
we are going to check if is a header on the request.
So if we get to react, we can see how easy this one is going to be.
So in the next video, I will show you a simple code how we are going to take the token and save it
into local storage, meaning that we are going to write some few lines of client side JavaScript to
get it done.