That was nice and easy.
And now let's work on a more proper functionality, more socially.
I also look for JWT.
So remember our Jason Web token and eventually we'll use the verify function.
Now, first, let me showcase the steps that we're going to take to get to it.
So in here again, I'm looking for my authorization header and I'm just going to add one more condition
and essentially not only we want to check for header.
But I also want the commission where I'll say, if the offender does not start with Bear, so if it
doesn't start with Bear Bryant again, we throw the authentication out and if we pass the commission,
then we want to split the string because remember the end of this offender as it's coming in, it is
a string.
And we want to split it.
On the space.
Why?
Well, because we have barer and then space and then a token, and then I want to select the second
value, meaning essentially with Split will turn into an array.
And then since arrays are zero in next best, the value zero will be bearer and token is actually going
to be the second value with the index of one.
And then once I grab the token, this is where we use the JWT Verify function, where the first thing
that the function is looking for is the token.
And the second one is not secret, which is sitting in our case in the process adopted.
So remember when we created the token, we used to sign the JWT seeker one.
So now, once we need to verify, actually, we'll have to use it again and then we get back the payload.
Now what is the payload?
Well, that is what we're passing in.
So in this case, we have here this user I.D. and then this I.D..
So this is the object that we're getting back in the payload.
And essentially, I just want to pass it on to the next middleware.
But before I do anything, I want to go to a request and add a user property.
And this will be equal to that object.
So then in my request, I can always access that user I.D. And there's million awareness how you can
ride that.
And I'll showcase some of them during the video and we go here with next.
Now, if this fails, so if let's say there's a issue with the token, for example, it might be expired
or I don't know, somebody tampered with the data, then we do the same thing like we're doing over
here in the commission.
Essentially, we throw the error.
Let's start working on that.
And the first thing that we want to do is import the or team.
Correct.
So let's go here and then let's say import.
The import JWT from and then we're looking for Jason Worth Talking Library.
Let's keep on moving and like I said, not only I want to check for the header.
I also want to check whether the header starts with a bar.
And if it doesn't, then of course we throw the error.
So let's say here after that and that starts with now this one is a JavaScript function, so it's not
like it's coming with node or the that we take.
This is built into JavaScript, where it can go it starts with.
And what is the value?
Well, in my case, I'm going to be looking forward to better.
So if that is the case when we throw the error.
Now, if everything is correct, we'll get back our token so I can simply go here with a token is equal
to all header.
And like I said, we'll use the split method.
So now we're turning into an array and then we'll say, let's let that string on the empty space and
then let me grab it right away, the second value in the array, which will be my token.
And then let's set up the try and get your gun.
So let's go, try catch.
I'll move the next inside of the tribe lock and I'll copy this line of code.
Essentially, the federal new error and set it up here in the catch because again, the idea is going
to be exactly the same.
So once I have try and catch in place, once I successfully can get the token.
Now let's verify it.
So we're going to go here with const and payload now will be equal to my JWT, then verify function
like I said, and it's looking for two things.
The token as well as process dot entry and JWT secret.
So JWT and then underscore secret.
And if everything is correct for the time being, I just want to lock the payload.
I want to showcase what do we have over there?
So let me say this again.
We need to navigate back to the postman and we need to properly set up the Badger token.
It's looking for a token.
Let me just double check whether token is present here looks about right.
And then once we send, we have update user.
So it looks like everything worked.
Now we just need to check what we have here in the console.
And if I take a look notice, I have user ID and then I have the expression.
So when the token is going to expire, as well as when it was issued, I noticed that.
Of course, this is done using the milliseconds.
That's why we have those massive values.
Now, if you want, you can set it up this way where you go with record users equal to payload because
essentially at the end of the day, we'll be looking for this user in the anyway.
Like I said, this user I.D. now will be used in any of the controllers that will rely on that user.
So for example, if I want to look up all the jobs for the user when I'm going to use the user I.D.
if I want to update the user info, I mean, again, I'll use the user already.
So hopefully that is clear.
So I can definitely do it this way.
You can just set it equal to this object.
Remember that you have these two properties or you can do it this way.
Where on copy and paste I'll come into south and it's actually my preference to basically go with user
ID.
And then that one is equal to a payload and user ID.
Maybe a little extra.
I mean, again, we can pass in the payload, but that's actually my preference.
So I'll leave the read just so you can see what are your options?
And then I want to do the same thing in my office where I'll navigate back and I just want to set up
my record user.
So this one will be where this one will be on the request object.
And then.
In those controllers, for example, update user will access it.
We'll take a look at the Iraq homework and also, hey, get me the User ID property and go next.
We pass it on to the controller and then in here we throw the error if we cannot verify the token.
Now, I don't think I'm going to go nuclear as far as testing.
Essentially, what I'm trying to say is I'm not going to go with every possible error as far as showcase
what is going to be responsible.
I think I'm just going to try to sign with and without token like we didn't already previously.
But what I want to do is go to my controller of the off controllers and that in here where we have update
user, I do want to showcase that we always, always have access to the user.
So if you go here with log and go with that user, if everything is correct, if we are passing in the
token, this will log the user in the update user.
So let's navigate to the postman.
I have the header with Mr. Bennett here and then that's the user.
So that is what we're going to use later in our controller.
And as you can see, since we have our token and have no issues, therefore we pass it on to the next
middleware.
But if I go to my user model and I remember that when we were creating the token we used expires in
and I purposely did not change this in the data entry because I don't want to restart everything.
Remember, every time you make some changes in data entry, you have to do that in this case are again,
I'll just copy and paste and let's change this around.
And if I remember correctly, if you just pass here the value, then no one will be treated in milliseconds
by default.
So if we go here with, for example, 100, well, this should be hundred milliseconds and as a result
of this, one should expire very, very quickly.
So let's try this one out where I'm going to go back to my logging user.
I want to get the new token.
That's a crucial part, because now this value also will be here different.
And then if we go right now to the update user, we should get back the 401.
And of course we do.
Again, that is going to be a response if our token has already expired.
So I don't think I'll leave this one for your reference.
I mean, you can kind of see how everything works on.
I'm going to send it back to my lifetime one.
And with this in place now, I can start setting up the update user controller.