Okay.
And once we know how we can access cookies in our auth middleware.
Now we'll set up the logic where we will remove all of the code that checks for the authorization header.
And instead we're going to check if the token cookie is present.
It's not much.
Basically, we just want to grab the token from the cookies.
Remember basically getting the object with the token cookie and we want to check whether it exists.
If it doesn't, then we'll go with 401.
And if it exists, then it will go with the rest of the code.
First, remove the header code and then we'll check for the token.
So let's go to auth and again, this is the first place where we start removing.
So please be very careful.
Essentially.
What we want to remove are these, I believe, what, four or five lines essentially starting with this
and then ending with that split.
We don't need to split anything anymore.
Essentially our JWT is the value of our token.
So let me remove these lines of code.
We should only have the cookies and try and catch because again, the token is going to be exactly the
same.
It's just how it is transported from the server back to the front.
And that's different right now.
So let's go here with Token nine and one is equal to req cookies.
And we want to go with token.
So then we'll check, will say if there is no token, what are we going to do when we want to throw
that on authenticated error, Correct.
So let's go with throw new and we're looking for the authenticated error and we already have it here.
So I just come up with the message.
Authentication and invalid.
Let's save it.
Now I'm going to move back to the front end.
I'll log out A to register or.
I'm sorry.
Let's log in.
Bingo.
Over here.
And don't worry about the fact that we're still sending the token back.
In our responses, in our Jason responses.
We'll fix that in a second.
Let's submit.
So notice we do have the token in our cookies, which is really, really awesome.
And now once we make the request, everything is correct.
So we still get back.
The response with all our stats.
Why?
Well, because the cookie is present and it has an expired.
However, if I remove it again, I'm just simulating here what happens once the cookie expires.
Once I do this, I remove the cookie notice.
Once we'll refresh, check it out.
We log out so the server effectively is just going to send back the 401.
And if that's the case, remember, we log out the user on the frontend.
And lastly, in this video, what I want to do is to remove token from all my JSON responses.
Notice we're not using it anymore.
Remember now in our auth middleware, we check for cookies instead.
So the front end does not need to store it anymore.
Hence we don't need to include it in our JSON response.
So now let's go to all three routes.
We have log in, register and update user and we want to remove that token.
Now we still want to send back the user and the location.
So those are two things that will still use in the front end.
Now, we won't store them in local storage in the upcoming videos, but we will still send them back.
So please keep that.
We're just removing the token.
So let's navigate to the controller.
And I guess let's start with the register.
Notice over here I have the token correct.
I don't want a token anymore.
I just remove it.
Let's keep moving.
After that we have token in the login.
Also don't need it.
And then last one is the update user.
Again, we just remove the token and once we have fixed the off middleware as well as the sponsors,
now I can move on to the next step.