In the last section we signed up to the Google of API and got our client id in our client secret.
At present we just copy pasted these two tokens into our index dodgiest file.
We just did that in case you took a long break between the last video and this one I did not want you
to have to go hunting around the Google Developer console trying to find these two keys.
Now we're going to hook the key is up to our Google strategy very shortly but before we do I want to
talk a little bit about what these keys are doing for us and some considerations that we have to have
around them.
OK.
So first off the client id.
That is what we're for you as a public tokin it is completely ok if anyone else in the world gets access
to that client id no problem whatsoever.
All it does is identify our application to Google servers and it's completely OK if we share that token
with the outside world.
However the client secret is a much more secure piece of information as evidenced by the word secret
in it right.
So this client secret is something that we do not want to share with anyone else by mistake or on purpose.
If someone else gets access to our client secret all of a sudden they will have elevated privileges
inside of our account which is definitely a worst case scenario.
So we want to make sure that we do not accidentally share this client secret with the outside world.
So why is this relevant and why am I bringing this up right now.
Well here's the thing.
At present we have committed to our project using get where you are using source control with get.
Right.
And we did that to do our deployment to Heroku.
Now it's entirely reasonable to assume that you might turn around very shortly and decide that you want
to push your project up to get hub.
Well if you pushed your project up to get hub and it contains the client secret.
All of a sudden everyone in the world has access to your repository and get hub can read your client
secret in plain text.
So in this section we're going to take a very brief detour away from all this passport stuff and we're
going to figure out how we can securely store our client secret inside of our project and make sure
that we do not accidentally push it up to get up.
So let's get to it now before we start the actual implementation here.
I want to very quickly say that we're going to do one kind of like brief implementation let's say of
storing this client secret but very shortly we're going to come back and improve it just a little bit
to handle our case where we're deploying to Heroku as well.
So I'm going to give you just a very sneak peek of a diagram here.
OK.
So this is eventually the type of setup we're going to do.
But right now we're going to take a little bit more straightforward approach but we're going to come
back and implement this flow in just a little bit for handling all the different secrets inside of our
application.
OK.
So here's what we're going to do.
We're going to find our server directory.
We're going to make a new folder inside of there called config.
And then inside of that folder we'll make a new file called Keys.
Yes.
Now we're going to store all of our different sensitive keys inside of this keys not just file and then
we're going to make sure that we never ever committed to get which means that we'll never accidentally
push it up to get up.
So I'm going to go back over to my index start just file.
I'm going to find my client ID.
Here it is right here.
I'm going to select the entire thing and then cut it.
I will then change over to my keys G-S file and I'll say module.
Exports equals an object.
I'll say Google client id and I'm going to paste the key as a string and make sure that I put a comma
at the very end.
And then as a separate second line I'll say Google client secret.
I'll go back over to the index dot js file or copy the client's secret and then paste it in here as
a string as well.
OK.
So just very quick what we just did.
We declared a module don't export statement.
This created an object and assigned it to the module that exports property that allows us to require
both of these properties into another file like say our indexed not Zsa's file.
So the module that exports statement will be seen a couple of times throughout this course and we use
it to export code and make it available to other files inside of our application.
So now that we have access to the client id and the client secret here let's make sure that we never
ever accidentally commit this file to source control with get.
So we're going to find my good ignore file.
Remember we had previously created the ignore file to say that we never wanted to accidentally commit
our node modules directory.
So inside a here we're going to add the file name of keys.
Yes.
OK.
And that's pretty much all we have to do.
You'll notice that inside of my code editor my code editor Adam automatically grays out files that will
not be committed to source control.
And so the instant I save my good ignore file with keys not G-S keys dot J s over in the file pane kind
of Grae's itself out to say oh this file is not going to be committed to get anymore.
All right.
So that's pretty much it.
Remember remember this is kind of a temporary solution that we're using right now.
Very shortly we're going to come back and take care of a little bit more complex and robust solution.
But I did not want to kind of stray away too far from the passport stuff that we're doing right now.
As a last step I'm going to clean up the two comments with the Klein ID and the client secret like so
and I'm going to save this file.
OK.
So that's it.
Let's take a break right now because I wanted to just take care of all this key safety stuff inside
of a single video so we're going to continue on the next section and we'll figure out how we're going
to import that he's not just file and make use of those two keys inside of our Google strategy.
So I'll see you in just a second.