All right.
And like I already mentioned quite a few times, in order to send the token back to our user, I'm going
to use the Http only cookie approach.
Now, if you're interested in learning more about the difference between the Http only cookie approach
and local storage, essentially I left some info in the Readme.
Again, the local storage approach is following.
Effectively we send back the token in the request and then the front end is responsible for storing
the value and then sending it back to the server.
Now when we use the http only cookie.
Essentially these cookies are sent back by default.
So on the front end, we don't need to do anything.
The moment we log in, we get back the cookie.
And then with every request, we'll send back that cookie.
And then on the server first we will grab the Json web token from that cookie.
Then we'll decode it.
Then we'll take a look at the user and then we'll access the resources.
Now, as far as the functionality, here's what we want to do.
We're going to go to auth controller and like I mentioned, we're not going to send back the token here
in the request.
Instead, we're going to set up a cookie.
And what's really, really awesome when it comes to express, it's actually very easy.
Now, before we set up that functionality, you know what?
Let's just set up the.
Response.
We are going to have so first of all, we're going to go with status codes and we'll go with okay,
so essentially we're sending back 200.
And then when it comes to Json, again, the token is not going to be located over here.
We just want to send back the message.
We're going to go with user logged in.
And in order to create the cookie, we go here with arrays.
So that's the response again.
And yes, essentially we have two instances right now and we are going to go with Cookie.
So that's the special method.
And in here we need to provide a few values.
First of all, what is going to be the name of our cookie and sky's the limit, but I'm just going to
go with Token.
Then we want to provide the value and the value is going to be actually equal to my JWT.
So whatever I'm getting back from create JWT.
And then again we have the options.
So one by one, let's set them up.
And yes, the first thing we'll do is Http only and we'll set it equal to true.
So essentially now this cookie cannot be accessed with JavaScript and of course as a result it's more
secure then we need to go with expires.
So just like our JWT, our cookies are going to expire and yes, it does make sense to have the same
expiration.
So if our JWT expires in one day, we want to set up the same value for our cookie.
But here's the gotcha.
When it comes to cookies, we're not providing here a string like one day, seven hours or anything
like that.
We need to go with milliseconds and that's why we'll add a bit more logic.
First of all, I want to create one day in milliseconds.
How is that going to look like?
Well, let's start with a variable first and we'll go with 1000.
Remember?
Each second is 1000 milliseconds.
We'll multiply this by 60.
So this is going to give us one minute.
Correct.
Then we'll multiply this by 60, which is going to give us one hour and then we'll multiply this by
24.
So this is going to be one day in milliseconds.
Okay, good.
And when it comes to expires, we want to create a new date instance exactly one day from now in order
to set it up.
We're going to go with date Dot now, which essentially is going to return the number of milliseconds
elapsed since.
January 1st, 1970.
And we just want to add that one day and effectively it means that our cookie is going to expire in
one day.
And also we have the secure property.
And if we set it equal to true, then this cookie can be only transmitted over Https.
Now here's the gotcha.
While we're developing, it's going to be Http.
And in order to fix it, we want to go over here with process.
Dot env.
And effectively you will go here with node underscore environment and set it equal to production.
So if we are in production environment, then yes, the secure property is going to be true.
If not, then we'll still be able to access it using Http protocol.
And with this in place now let's navigate to the login user.
Now let's send it.
Notice we only get the message.
But what's really interesting, we also have here this cookies tab.
So that's the one that we're looking at.
And if we click on it, notice I have my token and here I have the actual value.
So this is my cookie.
So again, unlike the previous approach when we were sending back the token in response, now we're
sending back the cookie.
Now, why is this so, so, so, so powerful?
Well, let me showcase.
I'm going to go first to.
You know what?
Let me navigate, first of all to the router or no, sorry, the controller, and I'm going to showcase
that with get all jobs.
Please keep in mind that of course the same is going to work with all of the requests.
And yes, we won't be able to access the cookie.
We need a specific library for that, but we are already moving in the right direction because if you'll
take a look at the request, you'll see that automatically browser is going to send back the cookie.
So what am I talking about?
Notice over here.
I'm logging the request in Get all jobs.
So now let's navigate to.
Our thunder client.
Let's look for job routes since we have successfully logged in.
Let's take a look at get all jobs request.
Let's send it now.
It's going to return nothing.
That's fine.
We don't have any jobs.
What we're interested is the request.
So let's scroll up over here and notice this one.
So automatically, with every request, once we have that http only cookie.
Set.
That's it.
It comes back with every request, which is, again, super, super awesome because we'll use this to
authenticate the user.
And essentially, if the token is there, if it's valid, then of course we'll allow the user to create
the resource, access, the resource and all of that cool stuff.
If not, then of course we'll kick back the user with some kind of error response.
Now before we connect the user and the job, because again, the jobs are going to belong to the users,
I want you to navigate back to your database and essentially remove both of them.
And this is definitely something I suggest doing because that way you won't run into some weird bugs.
Again, we'll connect the two in a second, but before we do that, let's start from the scratch.
Otherwise you'll have some old instances.
That might trigger some bugs a little bit later on.
So again, let's start from the very scratch.
So let's remove both of the collections.
And up next, we're going to connect the user and the job and we'll set up the auth middleware.