In the last section we finished up our serialise and serialise user functions.
We are now ready to tell passport that it needs to make use of cookies to manage authentication inside
of our application.
In this section we're going to go through the set up of all that stuff pretty quickly.
We will then test out our authentication flow in the following video.
And then after that we're going to come back and do a completely optional discussion about exactly how
passport is managing our cookies.
So again that is completely optional and we'll cover that in like a video or two.
So anyways let's get to it.
We're going to instruct passport that it needs to make use of cookies to handle authentication for us.
Now out of the box Express has no idea of how to handle cookies at all out of the box.
It doesn't do it.
So we're going to install a helper library called cookies session to manage cookies in our application.
I'm going to change over to my terminal.
I'm going to close my running server and we will install this library with and install dash dash save
cookie dash session like so
now while that does its thing I'm going to change back over to my code editor.
I'm going to find my index file and remember the index start js file is where we really do all of our
initial application setup.
And so this would be a great location for us to tell express that it needs to make use of cookies inside
of our application.
So I'm going to require two libraries at the top of the file.
I'm going to require the cookie session module that we just installed.
Whoops cookie session and then I'm also going to require in the passport library as well.
So remember what we've been saying we've been saying that we have to tell passport to keep track of
our user session or our user or user authentication state for lack of a better term by using cookies.
So we're going to tell passport that needs to do that inside this file but to enable cookies in the
first place and get expressed to care about them at all we have to make use of the cookie session.
So that's why we are requiring in both libraries here one is to give us access to cookies.
The other is to tell passport to make use of them.
OK.
So underneath our apt declaration on line 11 or so we're going to add in one statement that's going
to tell express that it needs to make use of cookies inside of our application.
Now we're going to add in some code for this.
We're going to talk very briefly about it but we're going to really get into exactly what it's doing
in that further optional video that we'll talk about in a little bit.
OK.
So if you don't care about what we're about to do I don't want to make you listen to all about all of
it.
So we'll talk about exactly what it does.
And just a little bit.
So right here we're going to say apt News.
This is a function we're going to pass to it cookie session.
We're going to call cookie session and then to that we're going to provide a configuration object configuration
object expects two different properties to be contained within it.
The first is a max age property max age is how long this cookie can exist inside the browser before
it is automatically expired for us.
We're going to use 30 days.
Now the only issue is that that 30 days has to be passed in as Micra early milliseconds.
So we will say 30 days 24 hours a day 60 Minutes in an hour 60 seconds in an hour and then 1000 milliseconds
to one second.
So this statement right here says I want this cookie to last for 30 days before it will automatically
expire and then the second required argument or assuming required property to this object is going to
be a key that will be used to encrypt our cookie.
So by default whenever we send out this cookie or this token in the cookie it will always be 100 percent
automatically encrypted so that people cannot manually change the user ID that we're stuffing in there
and somehow takeover or fake being someone else inside of our application.
So we're going to pass in a key property and this key is going to use to sign or encrypt our cookie.
Now of course any time we see the keys right here we want to always be thinking about hey I probably
don't want to commit this thing.
So we're going to create our keys or cookie key Scuse me inside of our config Yes file.
So let's flip on over to config keystroke genius and then inside of here we're going to add another
property.
So make sure you get a comma at the end of the line right above it and we'll call this cookie key.
Like so now your cookie key can be absolutely any random string of characters.
It's something that you can freely make up on the fly.
So I'm going to say basically that right there I don't think anyone's going to guess that anytime soon.
Now back inside of index us.
I'm going to pass that key that we just set up into this array.
So I'll say these dot cookie key now do triple check make sure you say t's right here and make sure
that you've got an array around our key this cookie session thing right here allows us to specify multiple
keys.
And if we do it will randomly pick one to use to encrypt any given cookie.
And so it's just here to ride or just allows us to ride multiple keys as an additional level of security.
OK.
So that's pretty much it for our cookie session.
So we spoke a little bit about the cookies session.
We haven't really spoken about a lot about what it does behind the scenes.
We also haven't spoken a lot about what this app used call is right here.
So both these topics will be covered in an optional video that we're going to be covering in just a
moment.
Again I don't want to make you have to listen to all this stuff because it's going to be a pretty long
lecture.
And at this point you might be already very bored with all this authentication stuff anyway.
So I want to make sure that you have the option to skip it if you want to.
Now the last thing we have to do inside this file is tell passport that it should make use of cookies
to handle authentication.
To do that we're going to add two additional calls right beneath the one that we just put together.
And the first one we will say apt use passport dot initialize and then make sure you get some parentheses
after initialize and then in the second call we'll say don't use passport dot session and then put down
a set of the seas as well.
OK.
So that's pretty much it.
And when I say pretty much it.
I'm talking about pretty much it for authentication in our app in general.
So we now have a complete authentication flow but we don't really have any means to really test it yet
or really be assured that a user is being correctly signed in.
In fact we don't even really know what a user being signed in really gets us anyways.
So one last thing I want to do is I want to flip over to the terminal and I want to start my server
up.
Now I'm just doing this right now.
We'll test our flow out in the next section.
But I just want to start my server right now to ensure that I don't have any errors popping up.
If you see the deprecation of Waring's remember those are totally OK to have.
But if you see any warning any errors right.
Excuse me then that means you probably have a typo somewhere and you'll want to do a little bit of trouble
shooting.
And if you can't figure it out remember hop over to course discussion and I'll help you figure out what's
going on.
OK.
So we finished up wiring up the flow but we still have to test it and really figure out what it means
to be authenticated inside of our application.
So let's talk about both those topics in the next section.