You know have an H2 T.P. request for logging in and you're validating the credentials that are provided
which is a great start in this video we're going to continue on.
And we're actually going to allow users to truly log in so they can perform other actions later on like
creating a new task.
So in the end of the day every single express route we define will fall into one of two categories.
It'll either be public and accessible to anyone or it sit behind authentication and you'll have to be
correctly authenticated to use it.
Now the only two routes that are going to be public will be these sign up route and the log in route
everything else whether it's related to users or tasks is going to require you to be authenticated.
For example if you're trying to delete a task I need you to be authenticated so I can make sure that
you are the one to create it.
I don't want you to be able to delete a task created by some other user.
What we need to do is set up the log in request to send back and authentication token.
This is something that the requester will be able to use later on with other requests where they need
to be authenticated.
So I could log in with my account I'd get the token back then I could go off and edit my user profile
or do something else like create a new task.
So the goal of this video is to figure out how we're going to create and manage those authentication
tokens.
What we'll be using in this course is what's known as a Jason web token or JWT for short.
The Jason web token standard is very popular.
It can be used for all sorts of things including authentication and with J W TS we'll be able to set
up everything we want for our little authentication system.
For example we'll be able to do things like have tokens expire after a certain amount of time so users
can't stay logged in for ever optionally we could never expire the token and allow a user to use it
indefinitely.
So let's go ahead and talk more about Jason Webb tokens or J.W. TS as I'll call them here and there
and to start we'll explore the library we're going to use which allows us to work with JWT ts in node
j s over in the browser.
What I'm gonna do is Google NPM Jason Webb token as one word and that is the package we're looking for.
The Jason Webb token library this provides us everything we need for creating these authentication tokens
and validating them making sure they are still valid for example making sure they haven't expired.
This is a super popular package with over a million weekly downloads and we're going to start by integrating
it into our application in index dot J s much like we did with B script J S once we understand how it
works will integrate it into the task manager app.
So down below in the terminal let's go ahead and get started by installing things I'll use control C
to shut down the dev server and from here NPM I Jason Webb token at the latest version which is eight
point four point zero.
Let's go ahead and get that installed and once it's installed I'm just gonna start up the dev server
once again and we'll mess around with it in my function over here.
Let's start up the dev server that's NPM run Dev.
And once we have that in place I'm going to clear the contents of my function and I'm going to swap
out the old require call with a new one right here.
Let's go ahead and create a new constant called JWT and we will get its value by requiring the following
the Jason Webb token library down below.
We're going to explore how we can create authentication tokens and how we can validate them.
Then we'll integrate it into the app to create a new Jason Webb token.
We'll be using the sign method available on JWT that is JWT dot sign.
Now sign does indeed take some arguments which we'll talk about in a second.
And the return value from sign is your new token.
In our case our authentication token this token will be provided to the client and then they can use
the token later on to perform those privileged operations like creating a task.
So right here let's take a quick moment to create a variable to store the token that sine returns.
Now these sine function itself takes two arguments.
The first is an object and the second is a string.
The object contains the data that's going to be embedded in your token.
Now for us using JWT is for authentication.
The only thing we really need to store inside of here is a unique identifier for the user who's being
authenticated.
In this case the user's I.D. works perfectly.
So the only property will set up on our payload is underscore I.D..
And I'll set the value equal to a dummy I.D. for the moment though later on it'll be the user's real
I.D. stored in the database.
So that is it for the first argument we could provide other pieces of information if we needed to.
But the I.D. gets the job done for our purposes.
Now that second argument this is a secret.
This is gonna be used to sign the token making sure that it hasn't been tampered with or altered in
any way.
All we need to do for this one is provide a random series of characters.
I'll just use a sentence like this is my new course.
Any series of characters will work.
So what we get back from sine that is the token will end up giving back to the user who's trying to
log in.
Let's take a quick moment to log it to the council and see what we get right here.
I'll be logging the token and then saving the program so our little function reruns and down below we
have a nice long series of characters.
This is our Jason Webb token now the Jason Webb token is actually made up of three distinct parts separated
by the period.
So I have two periods one here and one over here.
That means this is the first piece of the Jason Webb token.
This is a base64 encoded Jason string.
And this is known as the header.
It contains some meta information about what type of token it is.
It's a JWT and the algorithm that was used to generate it.
The second piece in between the two periods.
This is known as the payload or body.
This is also a base64 encoded Jason string.
And this contains the data that we provided which in our case would be the I.D. from up above.
After that last period to the very end of the Jason Webb token we have the signature.
And this is used to verify the token later on when we verify it.
We'll see how that comes into play.
So the goal of the Jason Webb token isn't to hide the data that you've provided right here.
This is actually publicly viewable to anyone who has the token they don't need the secret to see that
the whole point of the JWT is to create data.
This data that's verifiable via these signature.
So if someone else comes along and tries to change the data right here they're not going to be able
to do so successfully because they won't know what secret was used with the algorithm so things will
fail to prove this real quick.
Take a moment to copy that middle value so whatever you have between those two periods and we're going
to head over to the browser and we're going to go to base 64 decode dot org.
Now there's ways in programming languages where you can get this done but for this little example we
can just paste it in this box click decode and what do we see down below.
We see some Jason we have a Jason object with two values.
We have the one we provided underscore I.D..
ABC 1 2 3 being the value then we have AI 80 which stands for issued at.
And this is a timestamp letting you know when the token was created.
So this is exactly what's embedded in the part of the Jason web token right here.
Now that we've seen how we can create a token let's talk about how we can verify our tokens.
So back over in visual studio code what we're going to do is use that token and actually try to verify
it by running a another function that the Jason Webb token library provides.
This is JWT dot verify verify takes two arguments.
The first is the token you're trying to verify.
And the second is the secret to use.
Now in this case I need to use the exact same secret that the token was created with.
So I will take these string from up above and I will paste it down below.
Later on in the course you'll learn how to break this out into an environment variable.
But for now having these strings in line is perfectly fine.
Now verify is going to return the payload for the token if things went well.
And the token is valid.
Otherwise it's going to go ahead and throw an error.
So right here const data equals then down below.
I'll just use console dot log to dump the data to the terminal.
Now in this case the verification should work and down below.
That's exactly what's happening.
We run verify and we get our data back.
Now let's see what happens if things don't work.
If I mess these secret up and put to ease on the end in one case but not in the other.
I get a whole bunch of stuff down below in the terminal and the error up above is un handled promise
rejection warning Jason Webb token error Invalid signature.
So this is letting me know that the token couldn't be verified based on the input we provided.
These secret needs to be the same for both now one more thing we can do with Jason Webb tokens is expire
them after a certain amount of time which can be a really useful thing to do this when we create the
token.
We provide a third argument an object where we can customize it with some options.
One option is expires in expires in allows you to provide as a string the amount of time you want your
token to be valid.
So for example I could type in seven days as a plain English sentence or something like two weeks or
one month.
In our case let's go ahead and expire.
Our token after one second.
Actually let's go ahead and make it shorter.
Zero seconds.
So the token is technically never not expired.
If I go ahead and actually run the program down below what are we going to see.
We're going to see an error.
The JWT has expired since the token is never not expired.
Now if I were to crank that up to a more realistic value like seven days things would work as expected
because seven days do not pass between when this code and this code run it's a fraction of a second
and down below we can see that things are still working.
So here's what we're gonna do.
We'll use JWT signed to create authentication tokens.
Then later on we'll use JWT dot verify to make sure the user is authenticated correctly.
Let's go ahead and stop here for this one and we'll integrate J.W. TS into the task manager app in the
next one.