We are continuing to implement what is called authentication and authorization.
When we say authentication is a process of allowing a user to log in into an application where they
write, log in details, and that is what we have done so far.
A user can log in with email and a password.
So what about authorization?
Or authorization simply means that allowing a user to take any action after logging in and.
And for us, HTTP servers are stateless, meaning that as soon as a user log in our server does not
remember the log in user.
So how can we make HTTP servers stateful?
And we can achieve this one in a couple of ways.
One, we can use what is called cookie based authentication or session based authentication or token
based authentication using JWT.
All these forms of authentication, we have covered them in details and the authentication and authorization
in this particular course.
So we are going to make use of session.
So here is a flow.
As soon as a user log in, our server is going to generate a session or a token input in that way and
then assign to the user.
So upon every request a user will take, our server is going to check if that user is having the right
session.
If the user have the right session or token, then put it that way.
Then our server will allow the user to take any action.
So how are you going to make use of it?
So we are going to install a package called expert session.
Let me shut down the server and let me clear the terminal and make use of NPM.
I express dash session and hit enter.
Perfect.
So let me clear the terminal and restart the server.
We are going to configure it inside the server case file.
So I'm going to require the package as session is equal to require.
Express session.
So.
And the murderer's here.
I'm going to add what is called session configuration.
And here you go.
We make use of app.
Dirty use and I'm going to make use of session and as a function core with some configuration.
And as that's the first property, I'm going to be the secret and I'm going to use any random text here
and I can put this one inside environment variable.
So let me go ahead and do that.
So inside the DMV, I'm going to add a variable called Search searching key.
And I'm going to use my key.
You can use a nice string of characters here.
So inside the session, I'm going to make use of this environment variable.
So I'm going to remove this one and make use of process dot and v dot the variable name as searching
key.
The next property is going to be as we save and put it to force.
So this are just a configuration and you can find all this one inside the package itself and save or
initialize also to true.
And that is it.
So with this one, we have accessed what is called record session in any of our routes.
So let's go ahead and then console, look, record session inside the user's controller.
So let's go back to the log in here and here I'm going to console log what is called rec dot session.
And let's see.
Let's get back to the tender clients and then click on log in and let me check the terminal.
And you can see we have a property code section and inside we have cookie and then some properties inside
that.
So with this one, we can add the log in user into the session.
So with this we can save the logging user into session.
So let's see how we can add properties to the session.
So let's go back to the controller.
That's for the user and I'm going to add a property called log in user and it's equal to four.
Now let me say IMA.
So let's make the request and let's see.
Let me check the terminal and you can see that we got what is called Imma inside the console.
So with this one we can add the locking user into that.
So after logging in, we want to save the logging user into session.
At this point the user is log in so you can see that save the user into session.
Rick.
Dot session and I'm going to add a property called user found or user of.
Ane is equal to the user found here after finding the user by email, which is this.
So now anywhere in our route or controller we have access to the log in user.
So after that, let's go ahead and console that, log the rec session and going to see the log in user.
So here we go.
So let's provide the data to log in email.
Is going to be John at gmail.com and then password.
One, two, three, four, five.
And hit send.
Now let's check the terminal and you can see we have a property called user off and this contains the
log in user.
And for this we can send the data that you want to save.
You can see that way for me, I want to save all the ID of the user and that is what I want.
I want to save the ID of the user.
So here we go.
Inside here I'm going to make this of user found dot underscore ID.
So with this one, let's look in and check our terminal.
And you can see we have the user of the ID, all right.
Now that we can save the user into session, what we are going to do is that we are going to create
a murderer and that murderer is going to check if indeed a user is logged in.
If a user is logged in, you're going to have this property called user off.
So let's see how we can do about that one in the next video.