In this video.
Let's continue our authorization and then the authentication concept.
So what we have done is authentication, meaning that a user can log in into our application.
So like I said, HTTP servers are stateless, meaning that as soon as we look in our server does not
remember the log in user.
So we need to find a way to tell our server that this particular user has logged in.
In that way we are going to use a third party package called JSON web token.
In that way, we are going to create a token and then assign to a looking user.
So upon every request, the user will pass that token and then our server is going to check if that
token is valid or not.
Because of that, let's go ahead and create a function for that.
So in our terminal, we are going to install the package called JSON Web token and here we go and p
m I JSON Web token and make sure that you install the exact version that is 8.5.1 and let's hit enter
and perfect.
Everything is correct.
Let's clear the terminal and let's restart our server in the utils.
Let's go ahead and then create a function to create a token.
So here we go.
Let's create one file called generate token dot js.
And first is let's require the package pass JWT is equal to required and then JSON with token.
Next is let's create the function and the function name is going to be as generate token is equal to
for this I'm going to pass in the ID of the user that we want to assign this talking to as that and
here we go.
We are going to return from this function designed to.
So on the package that is a JWT, we have the method called sign and we are going to sign with the user
ID, we can sign with any property, but because the ID is unique, let's use that.
And then after that we're going to pass in the key.
So here I can say any key and we can put this one inside the environment variable.
So here we go.
After that we are going to pass in another configuration as expires in meaning.
When you want to expire this token, let's say every hour you won't expire the token, meaning we want
the user to log in back again or we can make it as ten days.
The choice is yours.
So now we are done with the token generation.
So let's go ahead and then export.
This function from this file is equal to generate token.
So now when a user logs in, we are going to generate a token for that particular user.
So here we go.
Inside the user's root, let's require the function called generate token and the auto import is working
fine.
So our card is on from here and where we log in.
So let me collapse this one and now we are working with the log in.
So when a user looks in, we are going to send a token back to the user and you're going to save this
one inside the user's browser.
So here is the generate token and then pass in the ID as user found dot underscore ID.
So now let's go ahead and then log in and let's see if we're going to have a token being generated for
us.
So here we go.
When I look in a moment of truth and here we go, we have the token being generated.
Well, we can also say that as soon as we register, we want to log the user in automatically.
In that way we can also send a token.
But I don't want that way.
I want the user to register first and then go ahead and then look in.
Great.
So now we are done with the token generation.
What has left is that we need to check the validity of the token, meaning that if a user make a request
and send this token, this token can be tempered or it can be changed.
So it means that any user can send any random token or server.
In that way they're going to receive some bugs in our application.
Because of that, JWT gives us a method to verify a token.
So let's get into that in the next video.