Great.
And let's start by setting up the cookie in the login response.
If we take a look at the express documentation, you'll notice that in order to set up the cookie,
we simply need to go with Perez.
Basically, that's our response.
And then Cookie.
And then we need to provide the name of the cookie, the value and also the options.
And of course, these are all the options that we can use.
And if you're looking, for example, basically we can go with the rest of that cookie name is going
to be name.
The value is going to be Toby, and then rest of the stuff.
Now I'll show you the options we are going to use.
So of course, yes, you can reference the docs, but in our case we use the expires.
The DPI only as well as the secure one as far as the setup.
You can add to any of the routes, but I think the logging one is going to be the easiest one.
So first, let's navigate to the fourth controller.
We're looking for the login route.
And essentially, right after we set up the token, right after we set up the JWT and all that, we
want to go with ROIs and Cookie.
Again, this is happening by default and all that, and now we want to provide those values.
Now, for time being, we'll still send back to Token with our JSON response, but that is not going
to be the case once we're done with the setup.
So let's start here with a name.
In my case, I'm going to go with Token.
As far as the value, this is where we want to pass in the token that we get back from user create JWT.
And then one more is the options object.
And in the options object, we want to go with HTTP only, which ensures that only the browser can access
that cookie.
Very, very important.
And then we need to go with expires.
Now, remember, the JWT has what it has, I believe, expiration for one day.
So it kind of makes sense that we do the same thing with the cookie.
Now, can you set up different expression?
Yes, of course.
But again, let me repeat, it kind of makes sense that they both expire at the same time and it works
exactly the same way.
Once the cookie expires, the cookie is not going to be present.
If the cookie is not present, then, of course, the JWT is also not located over there.
Again, if this sounds somewhat iffy, trust me, once we will start testing, you'll see what I mean.
So in order to set up the expires, we just need to go with expires properly and we need to set it equal
to and now this needs to be in the milliseconds.
Now, how can we get milliseconds?
Well, we can go with date dot now.
Correct.
And the way we can set up the expiration, we can create a new date, then get the date that now and
add one day since again, that's our expiration.
Now you can also add like 5 seconds or whatever.
And in order to get those milliseconds, basically that one day we need to do a little bit of math over
here.
So I'm going to go with const one day and now let's construct this one day in milliseconds.
So we know that one second is 1000 milliseconds, correct.
So if I want to get one minute, what do I need to do?
I need to go to 65,000.
Correct, then.
In order to get one hour, I go with 60 again.
So this is going to be one hour.
And then how many hours we have in a day.
Well, I don't know about you, but where I live, it is 24 hours in a day.
So now we have this one day.
And now let's set up that expiration.
We're going to go with a new date.
So we're constructing it.
Then in it will pass date that.
Now let's invoke it.
So we get basically the current milliseconds for this date, and then we'll add that one day again,
you can add 1000.
Basically, this cookie will expire in one second.
And once we'll start this thing, this is what we'll do.
But in general, go with one day and then we have that secure one, which means that we'll only send
the cookie.
If the protocol is HTTPS.
The thing is, though, we want to test it when we're developing.
Correct.
So here's what we can do.
We can say secure, but we're not going hard code this.
Well, essentially say that we want to check the node, underscore EMV value, and if it's production,
then we want to set it to secure.
If not, then we won't set it to secure.
Otherwise we won't be able to test out our application.
So this is located in a process dot EMV and then a node and underscore entry.
And yes, once we push this up to production, this value will be true and also secure will be true,
as I just showed you in the production application in the previous video.
So in here, we'll say if it's equal to production, then it's going to be true.
And then, of course, as a result, the secure will be true.
If not, it's going to be false and then we're still able to test it in the local environment.
That's it.
That's all we have to do.
For now.
We just go with the rest dot cookie.
And now let's navigate to the browser.
Unless the STROUT, of course, you can send a request in the postman, which is something that I'll
do at the very end of this video.
But for now, let's just test it on the front and then I'll open up.
We have tools.
I want to see the application since that's where the cookies are located.
So now let's log in.
And it looks like I have a tiny bug.
It's not the cookies.
It's a cookie.
My apologies.
Let me try one more time.
Yep.
Logging is successful, and of course, we'll still have everything in the local storage.
We haven't removed that logic.
But if we take a look at the cookies, check it out.
Now we have the token.
We have the JWT value domain path and all that.
Then we have expiration.
It is HTTP only, so only the browser can read it.
And we also have the size.
Now notice secure is not true.
Why?
Well, because we are in the development.
And what's really, really, really, really, really cool is the fact that automatically.
Browser.
Sends the cookie back with the future request.
Don't believe me.
Now let's refresh over here and let's say we're going to go to network.
Do you want to see the stats?
And now notice the cookies tab.
So this is the request that we're making.
And check it out so we automatically send this back.
Again why it's so important.
Well, because we don't have to store it anymore.
The token in the state or in the local storage, it's simply going to be added to all the requests and
then we can just check it on the server and be like, okay, is it valid?
Yes.
Good.
Here's your data.
If not, we lock the user out.
Or send some other error response.
And since we're using Express, it's really easy to use the cookie.
Simply go with that cookie and then store whatever info we want over here.
Of course, in our case, that's the JWT token.
And like I promised, I also want to show you the postman response.
So if I navigate over here, I notice I have the auth logging and all that.
I'm going to go with my email and password and once we send.
Yep.
So we get all this data.
But what I'm really looking for is the cookie is the token cookie where again I have all the necessary
info to set up auth for my application.