So now we got the theory
about sessions and cookies
and how we use those features
to implement real authentication.
How do we now actively write the code
we need to write for this?
Well, for that, it is again,
important to always keep in mind
that sessions and cookies can be
and will often be used outside
of authentication purposes,
so you can use them for a lot of things.
And you typically don't write all the nitty-gritty details
and all the deep dive technical code on your own.
But instead as so often,
you often rely on third-party packages
to do the heavy lifting for you.
And there when you work with node
and express for sessions,
the express-session package is the most popular one.
For cookies, we can work with cookie-parser.
Though if we don't work with
any other cookies then session cookies,
we don't need to install the extra cookie-parser package
since express-session
will automatically manage session cookies for us,
so then we don't need that extra package.
Of course if you would be using
our (indistinct) programming languages,
you also have similar session and cookie packages.
So this is not node JS express specific,
non of the back and concepts taught so far were.
This all applies to all possible
programming languages.
So therefore now back in our code here,
we can stop our server here
and quickly install the express-session package here
to work with sessions in our node express application here.
And once this was installed,
we'll not yet restart our web server data
because there is another package we'll need to install.
But for this, first of all,
let's go back into app JS because here
where we set up all the other things
for our web server as well,
we will also need to set up the session feature
because we'll implement this
as a middleware into our,
well request funnel here in the end,
because sessions are a general feature
and in the end this express session package
needs to run and needs to check on
every incoming request
so that a session can be generated
for every incoming request.
So for every user who's talking to our website
or so that an already created session can be identified
if a user who already has a session sends a request.
And again,
we will know whether a user already has a session or not
because of that cookie that contains the session ID.
So therefore here in app JS,
we'll start by simply requiring this session
packaged as express-session package
which we just installed.
And then we can register this middleware
and we can for example do this here
after a parsing request (indistinct),
the exact position doesn't matter too much.
Here we register it with app use as we did before.
And we simply execute session as a function here.
So this session,
which I'm importing here is simply executed
as a function here.
And this will then generate such a middleware function,
which is registered for is overall request funnel.
Now this session function,
which I'm executing here wants a JavaScript object
in which we can set various properties
to configure this session.
And we should set a couple of settings here.
For example,
the first setting which we should set is the secret setting.
And as always for such configuration objects,
these key names here like secret are not up to you,
instead the session package
will look for these keys
to know how it should work internally.
Now, secret is simply a string
that's totally up to you that is
used for securing this session.
That will all be done behind the scenes,
but here you should enter some secret key,
here I'll use super secret.
You might use a bit of a longer
and more secure string in reality,
but here for demo purposes I'll keep this simple.
So this is just some key that will be used internally
for securing the session
or to be precise also the session cookie.
And this is crucial to ensure
that a session can't be faked somehow,
that there really is no way for a client
telling you that he has a session
that might not have been created before.
So this should be set.
In addition,
we should set the resave option
and set this to false.
This will simply influence that a session
is only updated in the database
if the data in it is really changed.
If that would be set to true,
a new session would be stored in the database
for every incoming request
even if nothing about the session data changed.
And this can have a couple of disadvantages
if the same client sends a lot of requests
in a short time span
then saving the old session state
might not have finished yet
and it would then be overwritten by a new empty state,
which could be wrong
and therefore we wanna set this to false.
We also can and should set the save uninitialized setting
and also set this to false
so that a session is really only stored
in the database or wherever we wanna save it
once we have some data in it.
That data could be that authentication flag
but it could also be some other data
like shopping cart data
for a visitor of our website.
I'll get back to this shopping cart example
in the online shop project
later in the course by the way.
And then we got a last super important setting
and that's the store setting.
The store setting controls where the session data
actually should be stored.
And we've got a couple of options here
as I briefly mentioned before.
We can store session data in memory,
so in the memory of the computer
executing this node express application.
The downside of this is that
if we ever restart our server,
the data will be lost
and we could also run into problems
if we actually deploy
and published this website on multiple servers,
because we might need to handle a lot of traffic
and therefore we might not have some shared memory.
So this is really just an option for development
and not recommended for reality
if you wanna expose this website to real users.
You also can use file storage as a storage here
and that could be absolutely fine.
But in this case here,
since I'm already working with a MongoDB database,
I would like to use MongoDB and start.
And for that and for all those session storages,
we typically also install third-party packages
that will manage that storage for us
so that we'll manage the database
or a file access for us.
And to find a list of all these session storages,
it's best if you search for
the session package itself, express-session,
to visit it's page here on NPM or GitHub.
And then there in this documentation
you'll find a link to the compatible session stores.
And these are third-party packages
that implement different kinds of session stores
for different databases,
for the file system and so on.
And here, we will also find a mongodb-session store,
actually multiple mongodb-session stores.
We'll use this one here,
which is maintained by the MongoDB team
and therefore that's the one I'll choose here,
the connect-mongodb-session package.
And here we can learn how we can use this package.
It's pretty straightforward,
we have to install it,
then we have to import it
and then execute it as a function,
past the session as a parameter to function
and then just create such a store
by pointing at our server URL
and defining the collection
in which the session should be stored.
So that's what we'll do now.
I'll copy the package name here
and then run npm install
to install connect-mongodb-session,
so this package.
And then as a next step,
we just import it.
MongodbStore could be the name we choose here
and that's this connect-mongodb-session package.
Then here I'll create a MongoDBStore object like this
by executing mongodbStore as a function
and passing the session package object
to that function
so that internally these two things can connect.
And then this MongoDBStore thing here
is now actually a class,
a constructor function we can execute
to create a new object
based on a certain blueprint.
And I'll do this here.
I'll create my sessionStore
by calling new MongoDBStore
and to this MongoDBStore constructor,
we pass an object with configuration options
for this MongoDBStore.
And there for example we should set the URI,
so the path to our database.
In this case that's localhost:27017
for the locally running MongoDB database.
Then we can also add a databaseName here
to define the database
in which this collection
for these sessions should be created.
And there I wanna use the same database
as for all the other data,
so in my case that's auth-demo here.
So I'll use that here as a database name
and last but not least,
we define the collection
in which our session entries will be stored
and all simply name that collection sessions.
And that's now this sessionStore,
which we now as a last step can take
and assign as a value
for the store option here when we create our session
or when we initialize
our session package, I should say.
And that is it.
This is how we now install
and set up this session package.
Now with all of that done,
right now nothing changes
but now we will be able to use this session
in our application here.
And that's what I wanna do now.
And therefore we'll now see how we can utilize
such a session for authentication purposes
to lock down access to certain features
and unlock access with that session
before we then as a next step,
we'll also see how we can sessions
outside of the authentication area.
Now I just noticed that
when I tried to start my development server,
it crashes though.
And the reason for this is that I entered an invalid
connection string for the sessions to work.
This should not be local host 27017,
but instead mongodb://localhost27017,
just as it is in database JS,
it should be exactly the same URL.
So I'll save this here.
And with that if you restart NPM start,
now it should be running.