In the last section we finished up with the first phase of authentication side of our application so
the user has been sent to Google the user came back to our application and we now have some details
about the user.
So at this point if we are strictly following this diagram apparently we need to create a new record
in the database something something cookie.
OK.
Well this all seems kind of weird.
So maybe before we just dive headfirst into all this stuff I think that maybe we should have a little
bit of a discussion to figure out exactly what is going on with authentication in our app.
Why do we care about a database.
Why do we care about this cookie thing.
Why the heck are we even using Google Earth at all.
All like what does that really doing for us.
So in this section we're going to try to answer a couple of these questions.
Now I want to preface this talk I want to preface this video by telling you that some of the stuff that
we're about to discuss and really all this stuff in general is not easy.
It is not easy.
It's hard.
It's really hard.
It's really darned hard.
I'm not going to lie but the reason that we're going through all this is because that is why you are
here taking this course you're taking this course because you want to understand these hard to understand
things these tough things.
I could have easily said when I was putting this course together I could have easily said hey let's
go just do like a two new application with re-act redux Expressen Longo.
Just do a to do app and then call a day.
Call it a day and boom that's our course.
We can definitely take the easy way out here but that's not why we're here.
We're here because we want to learn and understand how these really complex and tough to understand
systems are working on our machines.
So kind of a pep talk to keep them in mind.
Yes this stuff is hard but you gotta take a little bit of time to kind of to digest it before you really
comprehend it and understand it.
So with all that in mind in this section we're going to figure out what it really means to be authenticated
inside of our application and why we care about authentication at all.
So we're going to look at a couple of different diagrams that are going to help us understand some kind
of basic concepts and maybe some of these seem really obvious to you maybe you understand them already.
But I want to make sure that we are 100 percent on the same page.
So the first thing I want you to understand is why we care about authentication at all like what it
really does for us and what it really means to be logged into our application.
So first thing to understand is that TTP is stateless.
Remember we communicate between our browser and our Express Web server by HTP requests.
And when we talk about AJAX requests Ajax requests are still HTP requests HTP requests are stateless.
And what that means is between any two given requests that we make HTP inherently just like right out
of the box without doing any special stuff with it has no way to identify or share information between
two separate requests.
And so what I mean by that is if we make one request from the browser to the server and say hey here's
some like email and password please log us in and the server says Oh that looks like the correct email
and password.
Great.
You're now logged in and then sends the response back and then say five minutes later.
We then do a follow up request and say hey can I have a list of all my different posts by default with
age TTP.
The server would say what.
Who are you.
You're logged in.
You say you're logged in.
Who are you.
I have no idea who you are.
So that is because by default information by Rick it between requests are not is not shared.
So we can't really identify who is making any given request between any given number of requests.
So how do we get around this because obviously we log into applications all day and we have this idea
of authentication.
So how do we actually solve this problem.
OK.
So here's what's really going on here is here.
This right here is what is really happening with every authentication scheme for every application you
ever use in your life.
You've got your browser your browser makes some requests to some server and says Hey please.
I mean you provide along some e-mail and password or maybe some username and password whatever might
be the server receives it.
It says OK it looks like you gave you the right e-mail and password you are now considered to be logged
in.
Here is some identifying piece of information that is unique to you.
Whoever just made this request right here here's some unique identifying piece of information to you.
And so the server responds with that unique identifying piece of information inside the request that
gets sent back to the browser.
And so we can refer to that as cookie token whatever calling that a cookie is super super correct.
It'd be best to refer to it as a token.
And so that's what we're going to refer to it as we're going to say that the server gives us back a
token and that token basically says hey this is my proof that like five minutes ago or one day ago or
three days ago I logged into the application and this token is unique to me like this token corresponds
to whoever made this initial log in request.
And so the key here is on any follow up request that our browser ever makes to the server.
We're going to include that little identifying piece of information that little token that token that
proves that we are the same person who had made that original log in request like five minutes ago or
one day ago or three days ago or whatever.
So when we make the follow up request to the server and include that token the server sees that token
it says oh OK this is the exact same token that I had previously given to this person over here who
had just logged in like yesterday.
You know what I bet you are the same person same exact browser.
So you're probably like user 1 2 3.
That same person.
Great.
Here's a list of all the posts where all the blog posts all the tweets all the e-mails whatever it is
that belong to you specifically user 2:59 or whatever their email is or whatever their username is so
this is the general idea behind authentication inside of our application.
We cannot rely upon just raw HTP to have this concept of authentication because that's not what HTP
is for.
We cannot correctly identify ourselves between requests.
So instead we rely upon this token or something to identify us between requests.
So how does that all have something to do with us and how are we going to actually apply that to our
application inside of our application.
We're going to use what is called cookie based authentication cookie based authentication.
What that means is that when we get some initial request to our server like our express API we're going
to say hey please log me in and this could be an email password it could be a username for us.
It's going to be a Google Earth.
So after a user goes through the old process you and I are going to generate some identifying piece
of information in the request Orsini and the response that we send back to the user for that very initial
request.
We're going to include what is called a header inside of the response that gets sent back to the browser.
The header is going to have a property called Set cookie and it's going to be set to be some random
token this token right here is what is going to uniquely identify this user.
Now here's the really important part.
When the browser sees this response come back and it sees in the header of the request it sees this
like set cookie thing.
The browser is going to automatically strip off this token.
It's going to store it into the browsers memory and then the browser is going to automatically append
that cookie with any follow up request being sent to the server and so on this follow up request the
server going to see that cookie being provided.
It's going to say oh inside that cookie is the same identifying token that I provided to this person
previously.
You must be that same person.
So great.
Here's the list of posts that you had previously made or the list of surveys or lists of e-mails or
whatever else it is that they're doing.
So again the entire key here the entire idea behind authentication inside of our application is that
we're going to put some identifying piece of information into the user's cookie that cookie is going
to be automatically managed by the browser.
And any time our browser makes some additional follow up requests to the server the browser is going
to automatically include that cookie in the request.
And so our server can look at the token inside the cookie and say Oh fantastic your user 2:59 you must
be the person who just lost us yesterday.
So here's your list of posts now to be clear.
We are using cookie based authentication here because it is very elegant in a very reasonable solution
for the type of application we are putting together.
It's fantastic because we don't have to worry about manually dealing with this cookie or this token
on the re-act side of our application as far as the re-act side of our application is concerned.
It's going to feel like we just magically are all of a sudden logged in because again remember the browser
itself is responsible for handling all this cookie stuff.
We are not the rock side of our application doesn't care about cookies and it's not going to deal with
cookies.
It's all managed automatically by the browser for us.
Now I will say that this cookie based approach right here does have a couple of shortcomings.
And so if you are familiar with Jason Webb tokens for example or other token based strategies that don't
involve cookies.
There is a very good reason to use those other strategies.
We will add a future point.
Or in a future video we're going to talk a lot more about some of the considerations around cookee based
authentication.
We'll talk about why we are using cookies and we'll talk about some of the other pros and cons around
using cookies.
But at the end the day.
Trust me this is a good solution for us.
OK.
So that's pretty much it for this video.
We now now have at least a somewhat more reasonable idea of what is going on behind the scenes and having
a better sense of this flow right here is going to give us a little bit better idea of exactly some
of the code that we're getting right in the coming sections.
Now one thing I do want to mention is that I have not really clarified exactly how a database record
comes into play here.
Like why we care about database records at all.
All I've really said is that hey after we've created this user we are then going to do something with
a cookie and send it back to the user's browser.
So we still have a little bit of work to do in that regard to figure out like what is going on with
the database here.
But hopefully now it's at least a little bit more clear why we are using or exactly how authentication
is going to working inside of our application.
OK.
So enough talking.
Again I apologize for the length of this video.
We are going to have many other lectures that are this long.
But again we are having these long lectures these complicated topics because this is the stuff that
you really need to learn to understand how web apps are built and how they work.
So enough for that let's continue the next section and continue working on our application.