All right.
So we can successfully register a user as well as login.
Now what?
Well, now we want to send back the Json web token.
So effectively the way it's going to work.
The moment user can log in.
He or she will receive a Json web token.
And then in order to access all of the resources aka jobs and also info about the user will be looking
for that Json web token in the requests that are coming in.
And what's more interesting in this application, we will send everything with Http cookies, which
is a very secure way how to communicate back and forth.
Now if you want to find out more info on Json web token.
Definitely utilize this resource in a second.
We'll actually look at it.
And again, Json web token is just a way to securely transmit the information back and forth.
So first, let's install the library we're going to use in order to create Json web token and library
name is Json web token and I'll right away set up the function in the utils.
And in this case I'm going to call this token utils and same deal.
We'll have one function to create Json web token and we'll have the second one where we'll decode it.
And that one will set up actually in our auth middleware, something we're going to work on later on.
So first let's navigate to a utils.
And we want to go with Token.
Utils.
That's going to be the file name.
Then let's create the function or not.
Let's first import the library we're going to use from and again, it's Json web token library.
Let's right away export since we'll invoke it in the login controller.
As far as the function, I'm going to go create JWT and it's going to be looking for payload.
Now essentially what do we want to pass in the payload?
Technically, we can pass anything we want.
In our case, we're just going to provide the user ID.
Why?
Well, because we'll use that user ID to pretty much get all the resources or create resources.
So of course, we can set up more data.
Just keep in mind that essentially we're not going to decode it on the front end.
This is very, very important.
So we'll send the token to the front end.
Then the front end is going to send it back with every request since the JWT is going to be located
in the cookie and then in the server, we again are going to decode it.
And therefore, yes, you can set up the username there as well, but there's really no need.
If you have the ID, you have access to everything that we need.
So that's why payload is going to be our parameter and then let's create that token.
So first I'm going to come up with the variable name.
I'm going to go with Token.
The method we're looking for is sign.
So JWT, then sign, and then we want to pass in three things.
First, we want to set up what we want to hold over here and again.
In our case, that is equal to our payload.
Then we want to go with secret key, which in this case I'm going to hardcode.
But in later videos we'll actually set up env variables.
And lastly, we have options object in here and we want to say in how long it's going to expire.
And in my case I'm just going to go with one day.
Again, these values will actually set up as env variables in a few videos.
So once we have the token in place, let's save it and effectively we want to navigate to our auth controller.
And if everything is correct, this is where we want to set up that token.
So first.
Again, let's create a variable over here.
Same deal.
I'm going to call this token.
So token over here.
Then let's invoke create JWT.
It's not asynchronous, so we simply invoke it.
And then, like I said, we want to pass in what is going to be our payload.
So first thing we want to set up the user ID And also since we have the role, you know what, let's
also pass in the user role.
That's going to be useful in our case.
So I'm going to pass it as an object and I'll just set up the properties.
Of course you can name the properties differently.
Just keep in mind that whenever you'll be setting up the auth middleware to use the same properties.
So in my case I'm going to go with user ID, and remember, if I bypass this condition, I'll have access
to a user object and in there I have underscore ID that's the ID property.
So I'll set up my user ID equals to user underscore ID, and then also I want to go with role and therefore
I'm going to go with user dot role.
So that's my token.
We have two approaches.
If you want, you can send it back with the response.
Probably something you have seen before.
For example, we are doing that in my React course now.
We're not building the server, but we're looking for a JWT.
We're looking for a token, and then on the front end it gets saved.
Most likely in the local storage.
So that's definitely one approach.
But again, in our case, we'll set up the cookie.
Now, just so you can see.
Essentially how it works.
I'm not going to go with the status right now, but I will set up a Json.
And then let's set up token equals to token.
Let's save it.
Let's navigate to a login user.
And if everything is correct, you should see this giant, giant string.
So this is our token.
This is what essentially the front end is going to be storing.
And again, the idea is following front end needs to send back this token and then on a server we will
decode it and right away in that token, we'll see.
Okay, so this is the user, this is the role and the rest of the stuff.
And before we move on to the next topic, I also want to demonstrate something and that is how we can
decode actually.
Here in this awesome resource.
Again, just click on debugger here.
Then remove whatever values they have over here.
Copy and paste and check it out.
So I'm going to have over here user ID.
So this definitely is my object.
Correct?
Because those are the properties I set up.
So this is my user ID and I can guarantee you that it actually matches the ID of John.
Let me check it here.
Yep.
It ends with F and also library creates these two properties.
So essentially when it's going to expire and when it was created and with this in place, we can set
up a cookie, the Http only cookie, which we're going to use to send the token back to the user.