In this video we're going to generate the sun web token and then store it inside of our cookie as a
quick reminder on how to use cookie session.
Once we have the Jason web token generated we can take a look down at the example section.
Is the example section on the cookie section session documentation right here.
That's how we store some information inside the cookie.
We do a rect session record session is gonna be an object that is created by the cookie at session middleware.
Any information we store on this object will be automatically serialized by Cookie session and stored
inside the cookie.
So once we generate that Jason what token we're going to set it on rect out session.
And that's pretty much it.
That's all we have to do.
So how are we going to generate the Jason web token itself.
Well we're going to use yet another package.
So once again on NPM just dot com I'm going to do a search for Jason web token.
There are many libraries with a very similar name.
So make sure you put Jason web token all one word with no dashes in it.
I'll then go to the first results.
It should have the exact name Jason web token there's really just two things you need to know about
this library.
It has a method that allows us to create a Jason web token called sign when we call sign.
We're gonna put in a payload as the first argument.
The payload is gonna be the information we actually want to store inside the Jason Webb token.
The second argument is going to be a signing key.
We will have a further discussion about this signing key and just a little bit.
The other thing about this library you need to understand is that there is a method called verify.
So this is how we're going to make sure that a user did not somehow mess around with the Jason Webb
token that was created.
We are also gonna use this method to pull information out of the Jason token as well.
So in other words the payload we had stored inside their OK so let's install this back in our terminal
so I'll go back over to my terminal we'll do an npm install Jason Webb token and this library has the
same issue as cookie session.
It does not have native typescript support.
So we have to add in a type definition file will add in at types.
Flash Jason Webb token quick reminder make sure you're inside of your auth project directory.
Let's run that these are once again very small modules so the installation should be pretty quick.
Once that's all installed I'm going to go back over to my editor I'm going to find my roots directory
and then the sign up folder inside their at the very top.
I'm going to import JWT
from Jason Webb.
Token
I'll then go down towards the bottom of our root handler right after we save the user to the database.
Right up that is probably when we want to generate the Jason Webb token and then set it on the session
on the Iraq object so right you're going to add some comments just to God myself we're going to generate
Jason Webb token for it on the session object OK so let's get to it to actually generate the Jason Webb
token we'll say const user JWT is data which you sign and then remember the first arguments.
This is the payload the information we want to store inside the Jason Webb token the only requirement
that we have for that payload is that we want to store inside there is some information about this user.
So again we don't want to just have the fact that a user is signed in we don't want to just have an
empty J somewhere token we want to know who this is and all of our other services that we are going
to access the information inside of here.
So at present the only real information that we have about a user is their I.D. that was generated by
Mongo DB.
We've got their email and their password.
We probably don't want to share the password around with the world even though it is hash insulted but
we probably do want to share the I.D. and email so when we sign the thing or when we generate the Jason
web token we're going to provide a payload that has the idea of the user as user I.D. We'll have the
email of the user as user dot.
Email.
I'm still getting an air here.
That's because we are not providing the second argument of these secret or private key.
Now as a reminder I said just a moment ago we're going to discuss this private key in just a moment
and how to securely handle it in a Cuban ladies and Doctor environments right now.
We'll just leave in a SDF.
They're going to come back and replace that very shortly.
Yes that's going to generate our Jason Webb token one little mistake here.
If we double check the signature of this thing turns out that when we generate the Jason Webb token
we have either an async or synchronous mode.
We can go back to the documentation.
So it will run asynchronously if we provide a callback in our case we are not providing a callback.
That means we should get the Jason Webb token back instantly after it's been created.
Now we're going to take that user Jason Webb token and we're going to store it on our session.
They'll do a wreck dot session dot JWT is user JWT
now.
So getting a little error right here.
The reason for that the type definition file that we installed for Cookie session is not assuming that
we actually have an object present as record session rather than trying to just directly set a property
like this right here which is what you saw back in the documentation.
Usually what we do with typescript just to kind of circumvent this or get around this whole issue we
usually redefine the entire object and set it on rect out session will create a new object give it a
JWT property and input our user Jason Webb token on there.
Again that's just because the type definition file that's being handed off to Jason or something to
typescript doesn't want us to assume that there actually is an object on record session OK.
So that looks pretty good.
So we generated our token we set it on the session.
The cookie session library is going to take this object serialize it and then send it back to the user's
browser.
So last thing here.
Let's save this and let's do a quick test over in postman.
So back inside of postman here we are right here.
I'm going to change the e-mail address to something that is unique.
Once again I'm going to make sure I've got a body requests or C I have body with raw and Jason selected.
I'll make sure I've got a content type of application.
Jason and I'll go ahead and send this thing now after I send it.
We'll go over to the cookies tab right here and you'll notice no cookies where you turn from the server.
Even though we successfully logged into the application the reason for this once again is because the
cookie at session middleware that we just wired up we configured it to say ignore any cookies that or
do not try to manage any cookies if the user is connecting over in each TTP connection.
Right now we are making a request to ticketing dot dev and we have not specified the protocol which
means that postman is going to default to H TTP if we change this to H TTP s o n slash slash and then
make the request again.
OK.
Well emails in the US got a unique email and once I do now we are connecting over an h t DP s connection.
If I go to the cookies tab now I'll see that a cookie has been sent.
And so this right here this is our actual Jason web token.
That's it well it's Alex pretty good.
A quick thing here.
If you made this follow up request and it resulted in an error if postman said sorry insecure connection
or cannot connect or something like that but it was working previously without the HDD P.S. then here's
what to do.
Go up to postman preferences and then on this menu you're going to make sure that SSL certificate verification
is turned off because remember right now we have an invalid temporary certificate being served by ingress
engine X after you turn that thing off you should then able to be able to make a request with HPD.
Yes and have it go through.
All right.
So that's it.
We've now got our cookie being set.
We've got our identifying piece of information on there which means any time we make a follow up request
to anything at ticketing data.
So any service and the rest of our application this cookie right here will be included and we're going
to get our Jason web token.
So let's take a pause right here and continue in just a moment.