We've now established how we're going to handle all things authentication.
So we're going to have a Jason web token as the actual authentication mechanism.
And we're going to store or manage this chase on a token through the use of cookies.
All right.
So with all that in mind.
Quick and a summary diagram right here of what is going on during the sign up process is that is still
the thing that we are working on around our auto service right now.
So we've gone through everything inside of your or hashing creating the user and storing them and considering
user to now be logged in.
We're going to handle that by sending back a Jason web token in a cookie though in other words we need
to send back a response that has a header of set cookie and that should have the Jason web token more
or less inside there.
So how are we going to actually handle cookies.
We're not going to handle them manually.
Instead we're going to use a little helper library.
We're going to use across all of our different services to read data out of this cookie.
Let's take a look at the documentation for the cookie managing library.
We are going to use inside of a new browser tab.
I'm going to go to NPM J ask.com and then once there I will search for Cookie session.
All right.
So here's the documentation for it.
If you've never used cookie session before.
Feel free to read through this thing really quickly.
The nice thing about cookies session in particular is that it allows us to store a bunch of information
inside the cookie itself.
And that's one of the big things that's mentioned right here.
Remember that is a really big deal for us because as we had previously discussed back in our list of
requirements we had said that we did not want to have to have a requirement of a backing data store
or something like that on our individual services cookie session is specifically designed to not have
to rely upon a backend data store.
And again you can read the documentation right here that kind of expands on that just a little bit.
Now you might recall that one of the other issues we discussed or one of the other requirements we had
said that we kind of didn't really want to use cookies because we want to have a solution was easily
understood between different languages.
Cookies sometimes are a little bit challenging to handle across different languages.
And the reason for that is that oftentimes you will see that the contents of a cookie will be encrypted
in some way.
So cookie session does handle or support encryption.
We can use cookie session to encrypt the contents of a cookie that can really get us into trouble because
cookie session is going to use some very particular encryption algorithm to encrypt the cookie.
If we go off to Ruby on Rails and we need to read the contents of that cookie now we're going to need
to make sure that Ruby on Rails can also support this encryption method as well so.
Is that going to be an issue here.
Well we're going to kind of circumvent this whole issue of having to worry about being easily understood
between different languages.
And really this entire idea of encrypting the contents of a cookie.
So I want to show you a diagram I got.
So we need to make sure that the contents of the cookie is easily understood between different languages.
The reason that is a big problem most frequently is because we encrypt the data in the cookie.
So again as I just mentioned cookie session might use some particular encryption algorithm that might
not be easily supported by another language.
So you're to get around that you and I are simply going to not encrypt the cookie contents.
Now that might sound like a huge security issue.
This essentially means that whatever information we store inside the cookie is going to be easily read
by users.
And in theory malicious users but that is really not a big deal for us.
Remember Jason Webb tokens are naturally tamper resistant.
If a malicious user starts to try to modify the information inside of a js on a Web token we are going
to know right away we're going to see that the Jason Webb token is invalid because a user tried to tamper
with the data inside their and that's really what we care about we want to make sure that users are
not able to modify the information stored inside this cookie.
And Jason what tokens are going to naturally prevent that from occurring now if this entire idea of
having information that is unencrypted is really scary to you in any way I'm telling you right now that
this is generally not a big cause for concern unless you are trying to store protected information inside
of adjacent web token which you should not be doing anyways or inside of a cookie which you should not
be doing anyways if that's still a big deal to you.
You can always just go ahead and encrypt the cookie contents feel free to do so.
Not a big deal but you just keep in mind you kind of run the risk of going and trying to create on their
service in a different language and running into issues and trying to decrypt the information inside
there.
So again just a little bit of a disclaimer.
OK.
So cookie session is what we're going to use because I've been doing so much lecturing inside this video.
I don't want to install this right away because sometimes people like to skip around inside of a video
and I don't want you to skip the or skip over the installation guide.
So another quick pause right here.
Come back next video we're going to tie this thing up to our art service.