1 00:00:07,840 --> 00:00:09,040 Welcome back. 2 00:00:09,070 --> 00:00:15,250 In this video, let's continue the authorization and the authentication system. 3 00:00:15,580 --> 00:00:22,090 So where we left in the previous video, we are on track, but we are lacking something. 4 00:00:22,150 --> 00:00:29,080 Meaning that when a user make a request to this endpoint, the user is going to copy a token and then 5 00:00:29,080 --> 00:00:30,820 paste it into this function. 6 00:00:31,030 --> 00:00:38,170 But instead a user is going to send a request and attach a token as part of the header. 7 00:00:38,170 --> 00:00:45,120 So our responsibility is to grab the token from the header and then we verify. 8 00:00:45,190 --> 00:00:49,810 So let's see how a user can send a request with a token. 9 00:00:49,930 --> 00:00:58,150 So inside the tender client, let's go to the profile route and here we go for this one. 10 00:00:58,150 --> 00:01:02,640 We have couple of tabs here, query headers, body and end off. 11 00:01:02,710 --> 00:01:09,130 Let's click on headers and here we can send a token using this header. 12 00:01:09,310 --> 00:01:17,710 So we are going to type in authorization and select that and for the value we are going to use bearer 13 00:01:17,710 --> 00:01:19,960 and then space as that. 14 00:01:19,960 --> 00:01:23,980 The next step is that we are going to copy the token. 15 00:01:23,980 --> 00:01:34,240 So inside the root of user logged in, let's go ahead and then copy the token from here and let's get 16 00:01:34,240 --> 00:01:43,270 back to the profile and for the value for this one less piece, it's now when I hit send I get back 17 00:01:43,270 --> 00:01:44,410 the response. 18 00:01:44,410 --> 00:01:49,330 So how are we going to receive the token from the request? 19 00:01:49,330 --> 00:01:53,380 So back to the user controller and that is a user profile. 20 00:01:53,500 --> 00:01:54,880 So here we go. 21 00:01:54,880 --> 00:02:03,070 For the meantime, let's comment this one and let's work with how we can get a token from the header. 22 00:02:03,160 --> 00:02:04,540 So here we go. 23 00:02:04,570 --> 00:02:15,820 How to, how to get the token from header and here we go. 24 00:02:15,940 --> 00:02:19,750 If you console.log rec dot. 25 00:02:22,120 --> 00:02:23,000 Henares. 26 00:02:23,020 --> 00:02:31,390 We have the head of properties, so let's save it and let's make a request, get signed and let's check 27 00:02:31,390 --> 00:02:32,410 the terminal. 28 00:02:32,650 --> 00:02:40,540 And you can see we have the object property and what we added is what you call the authorization and 29 00:02:40,540 --> 00:02:41,800 then the bearer. 30 00:02:41,920 --> 00:02:47,880 So what we want is the actual token, but not with the bearer. 31 00:02:47,890 --> 00:02:52,150 So we need to extract this one from the header. 32 00:02:52,150 --> 00:02:54,640 So how are we going to do that one? 33 00:02:54,640 --> 00:02:59,800 So inside the user controller, to be more precise, the user profile. 34 00:02:59,830 --> 00:03:03,880 So here, let's go ahead and get the header object. 35 00:03:03,880 --> 00:03:05,200 So here we go. 36 00:03:05,500 --> 00:03:09,400 Let's move everything from here to have some enough room to work with. 37 00:03:09,400 --> 00:03:13,030 So it comes as the header. 38 00:03:14,580 --> 00:03:22,290 Object is equal to req taught headers if you see that in the console. 39 00:03:22,440 --> 00:03:23,100 Yes. 40 00:03:23,400 --> 00:03:26,410 Next is let's grab the token. 41 00:03:26,430 --> 00:03:31,890 So const token is equal to header object. 42 00:03:31,890 --> 00:03:34,710 And we want the authorization. 43 00:03:34,710 --> 00:03:41,700 We can use what is called the authorization and we can also get a property using the square bracket 44 00:03:41,700 --> 00:03:42,690 as that. 45 00:03:42,690 --> 00:03:47,490 So here our pass in the property or authorization. 46 00:03:49,080 --> 00:03:51,210 And I want to play it. 47 00:03:51,750 --> 00:03:53,790 I want to split with this space. 48 00:03:54,060 --> 00:03:57,520 And I would take the second index. 49 00:03:57,540 --> 00:03:59,370 Remember when we split it? 50 00:03:59,400 --> 00:04:00,720 Let me show you something here. 51 00:04:01,950 --> 00:04:02,550 Sorry. 52 00:04:02,790 --> 00:04:08,130 When you split eight, I'm going to have two properties inside the array. 53 00:04:08,160 --> 00:04:14,880 When you have the first one as bearer and the second one is the actual token, the bearer is at zero 54 00:04:14,880 --> 00:04:17,890 index and the token as index one. 55 00:04:17,910 --> 00:04:20,640 That is why we are taking four here. 56 00:04:20,670 --> 00:04:21,410 Perfect. 57 00:04:21,420 --> 00:04:25,710 So if you console dot, lock the token. 58 00:04:25,830 --> 00:04:27,480 Now let's check it out. 59 00:04:27,510 --> 00:04:32,940 Let's send the requests and let's see a we have the token down here. 60 00:04:33,240 --> 00:04:40,020 So we are going to take that one and pass to our verification token, and that is it. 61 00:04:40,110 --> 00:04:41,520 So here we go. 62 00:04:41,550 --> 00:04:49,910 Let's bring in the function to verify the token as verified token, and we pass in the token. 63 00:04:49,920 --> 00:04:59,760 So here as cons as before result is equal to that and we can go ahead and then consume that log the 64 00:04:59,790 --> 00:05:07,020 result and here we go and we get back the actual user. 65 00:05:07,260 --> 00:05:15,180 So as soon as we get this one, we can save the user ID inside the request object. 66 00:05:15,180 --> 00:05:21,360 So upon every request we're going to have this user inside our root. 67 00:05:21,540 --> 00:05:28,920 And for this one too, we can make a request to MongoDB and find the actual user and put it inside the 68 00:05:28,920 --> 00:05:30,080 request object. 69 00:05:30,090 --> 00:05:33,190 But convention we only use the ID. 70 00:05:33,210 --> 00:05:35,850 So how are you going to implement it? 71 00:05:35,880 --> 00:05:41,430 Well, we are almost there to complete with the authentication and then the authorization. 72 00:05:41,520 --> 00:05:48,270 So what has left is that we are going to create a middleware and that middleware is going to check if 73 00:05:48,270 --> 00:05:50,810 the token is valid or not. 74 00:05:50,820 --> 00:05:53,970 So let's get into that in the next video.