Welcome back.
In this video, let's continue the authorization and the authentication system.
So where we left in the previous video, we are on track, but we are lacking something.
Meaning that when a user make a request to this endpoint, the user is going to copy a token and then
paste it into this function.
But instead a user is going to send a request and attach a token as part of the header.
So our responsibility is to grab the token from the header and then we verify.
So let's see how a user can send a request with a token.
So inside the tender client, let's go to the profile route and here we go for this one.
We have couple of tabs here, query headers, body and end off.
Let's click on headers and here we can send a token using this header.
So we are going to type in authorization and select that and for the value we are going to use bearer
and then space as that.
The next step is that we are going to copy the token.
So inside the root of user logged in, let's go ahead and then copy the token from here and let's get
back to the profile and for the value for this one less piece, it's now when I hit send I get back
the response.
So how are we going to receive the token from the request?
So back to the user controller and that is a user profile.
So here we go.
For the meantime, let's comment this one and let's work with how we can get a token from the header.
So here we go.
How to, how to get the token from header and here we go.
If you console.log rec dot.
Henares.
We have the head of properties, so let's save it and let's make a request, get signed and let's check
the terminal.
And you can see we have the object property and what we added is what you call the authorization and
then the bearer.
So what we want is the actual token, but not with the bearer.
So we need to extract this one from the header.
So how are we going to do that one?
So inside the user controller, to be more precise, the user profile.
So here, let's go ahead and get the header object.
So here we go.
Let's move everything from here to have some enough room to work with.
So it comes as the header.
Object is equal to req taught headers if you see that in the console.
Yes.
Next is let's grab the token.
So const token is equal to header object.
And we want the authorization.
We can use what is called the authorization and we can also get a property using the square bracket
as that.
So here our pass in the property or authorization.
And I want to play it.
I want to split with this space.
And I would take the second index.
Remember when we split it?
Let me show you something here.
Sorry.
When you split eight, I'm going to have two properties inside the array.
When you have the first one as bearer and the second one is the actual token, the bearer is at zero
index and the token as index one.
That is why we are taking four here.
Perfect.
So if you console dot, lock the token.
Now let's check it out.
Let's send the requests and let's see a we have the token down here.
So we are going to take that one and pass to our verification token, and that is it.
So here we go.
Let's bring in the function to verify the token as verified token, and we pass in the token.
So here as cons as before result is equal to that and we can go ahead and then consume that log the
result and here we go and we get back the actual user.
So as soon as we get this one, we can save the user ID inside the request object.
So upon every request we're going to have this user inside our root.
And for this one too, we can make a request to MongoDB and find the actual user and put it inside the
request object.
But convention we only use the ID.
So how are you going to implement it?
Well, we are almost there to complete with the authentication and then the authorization.
So what has left is that we are going to create a middleware and that middleware is going to check if
the token is valid or not.
So let's get into that in the next video.