Slowly but steadily, this application is taking shape, I mean we're still only working on
the users part, we haven't started working on the events part yet, but this is of course
an important part and we're seeing how we can use AI for different use cases.
Now one thing is still missing here for this part regarding authentication, signup, login,
and that's the JSON Web Token part.
And here I don't want to go into too much detail because it's not the focus of this
course, but in the end this JSON Web Token thing I'm mentioning here is simply a popular
approach for actually adding authentication to REST APIs.
Because right now we're able to sign up users and we're able to log in users, but if we
had some application, some frontend that would use this API on the backend, then that
frontend application would need some identifier, some token it could store which it could send
with subsequent requests to other routes, for example to routes that allow us to create
or edit events to prove that it previously did sign up or log in a user.
So some proof that some decoupled frontend has an authenticated user.
We need some proof and that's such a JSON Web Token which we can generate and issue
on the server when the signup or login route is hit and which we then send back to the
frontend when that happens and then the frontend could store it and send it for subsequent
requests.
And we'll see it how it gets used in practice over the next minutes and lectures of course.
Now therefore we need to generate such a token and there is a package that can help us with
that.
Hence I'll quit this server and now run npm install to install that package and the name
of that package is JSON Web Token.
And we could ask AI about this.
We could also ask chat, gpt or clod to explain this approach in greater detail but here I
already know what I need to do so I will just install this package, restart my development
server here and then use this package to create such tokens when users are created or logged
in.
Now we could store the code where we generate such a token here in this user's controller
js file but I'll actually outsource it into a separate folder and file.
For that I'll add a new folder which I'll name util for utility and in there I'll add
an auth.js file and it's in this file now where I want to add utility methods for creating
and verifying tokens which I will then need later in different parts of the app.
So it's in this file where I'll now tell cursor to add functions for generating JWTs
with the JSON Web Token package and for verifying.
The JWT, the JSON Web Token should include the user ID and email of the user to whom
it belongs.
And now if I hit generate hopefully the AI again goes ahead and tries to add functions
that will do exactly what I told it to do.
Now this JWT secret thing here is important because these tokens that are generated are
generated with help of a secret key, a secret string which only we on the backend know which
we will use for verifying the token to make sure that any token that's sent to the backend
from some frontend is really a token that has been generated by this backend.
So that not any arbitrary token is accepted but only tokens that have been generated by
this very backend.
And this is confirmed by using a special key which only we on the backend know for generating
those tokens.
That's why this part here is important and correctly included by the AI here.
And this secret is used for both generating and decoding and verifying tokens.
So we got these utility functions here looking good to me.
I will actually remove this error handling code here, don't need that, whoops, like this
and then accept this part.
Yeah, sure.
And that can be removed too with tab.
Thank you. And therefore this is now the final file.
Here you can enter any secret key you want like ABC test token
But again, that is up to you. And now with these functions added and exported here
We can use them in other files like for example in the user controller file
Where I now want to generate and send back tokens to the front-end who tried to sign up or log in a user
So I will select the entire code here and say use the
And then again, I'll point at the generate token function with at
Code and then generate token
function to generate
JWT's which are sent back with the response after
successful sign up or log in
And
Then again, the appropriate changes are hopefully made like adding this import here and
Then down here the token is generated
and
Attached to the outgoing response for sign up and the same for login
Again, we could have done this manually, but it's arguably maybe a bit quicker if we use AI for that
But as always it's up to you and it's simply also a game of trial and error
To find out what's quicker and what works best for you
With that all done if you save everything and you try logging in again by again sending a POST request to the login route
with valid email and password
You should get back such a token here
And that is a token you would normally store
Somewhere if you were a front-end if you were a mobile app, for example that communicates with the API
You would store that somewhere in your internal storage
And you would then send it back to that REST API for future requests to other routes
Which are only available to authenticated users
And that's exactly what we'll work on next other routes which are only available to authenticated users