‫So previously, we already implemented
‫a simple signup functionality,
‫but in this lecture,
‫we will actually also log the user in
‫making a more real signup process.
‫So starting from this lecture,
‫we will really start to implement our authentication,
‫and so this where it gets really serious.
‫And so therefore, before we start
‫I want to give you a warning here,
‫so authentication is very hard to get right
‫and many tutorials out there that you're gonna find
‫when you search for authentication
‫with like Node.js and Express,
‫many of these make many serious mistakes
‫and oversimplify things that should not be simplified.
‫All right, this is not to say that all tutorials out there
‫are bad, all right,
‫or that are useless or something,
‫but I really spend weeks researching all the best practices
‫and refining and improving my code,
‫to make this authentication section
‫that we're gonna start implementing now as good as possible,
‫for a beginner like you, all right,
‫and that is because we need to be really really
‫extra careful when writing this part of the application,
‫because remember, our user's data is at stake here,
‫and the trust in the company who runs the application,
‫is at stake as well,
‫and so implementing authentication,
‫is a real responsibility
‫where you should not make any mistakes at all.
‫Now there are some libraries out there
‫that can help us implement authentication
‫and authorization and the most well known one
‫is called Passport,
‫but even a library like that
‫doesn't take all the work and all the responsibility
‫away from you, all right.
‫Now in this case here,
‫we are actually gonna implement the whole login
‫protecting and authorization logic all by ourselves,
‫except of course for the Jason web token implementation
‫that we talked about in the last video itself.
‫Okay, so all the signing and verification
‫all that stuff, we're gonna leave to the WJT library
‫but then the rest, we're gonna implement ourselves
‫over the next couple of lectures.
‫Now as I mentioned earlier,
‫we already have our signup function here, right,
‫but right now, all it does
‫is to simply create a new user
‫and then send it back to the client.
‫Now shortly after finishing recording this course,
‫I actually noticed that
‫there is a very serious security flaw
‫in this way of signing up users,
‫so basically the problem is that right now,
‫we create a new user using all the data that is coming in
‫with the body right,
‫and so the problem here is that like this,
‫anyone can specify the role as an admin right,
‫so basically, everyone can now simply register as an admin
‫into our application,
‫and so that's of course not we need.
‫So again this is a serious security flaw
‫and we of course we'll need to fix that
‫and to fix is actually quite simple.
‫So what you need instead of this line of code,
‫that is selected here
‫is this piece of code that I just put here on the screen.
‫Okay.
‫So again, please go ahead and delete this line of code
‫that is currently selected here
‫and replace it with the code that I just put here
‫on the screen.
‫Now what's actually the big difference here,
‫well, with this new code,
‫basically we only allow the data that we actually need
‫to be put into the new user
‫so just a name, the E-mail and then the passwords.
‫And so now, even if a user tries to manually input a role,
‫we will not store that into the new user,
‫and the same for other stuff,
‫like for example, a photo.
‫So this is the quick and easy fix for that problem.
‫Now what this will do,
‫is that we can actually no longer register as an admin,
‫and so if we need to add a new administrator
‫to our system,
‫we can then very simply just create a new user normally
‫and then go into MongoDB Compass,
‫and basically edit that role in there.
‫So edit it from user
‫to admin manually, okay.
‫Of course we could also define a special route
‫for just creating admins
‫but that would be a bit too much.
‫Okay, so let's now move on.
‫Just notice that the code in the rest of the video
‫and all the videos in this course
‫will of course still be this old wrong version, all right,
‫but actually in the final code
‫that is in the GitHub repository,
‫I already fixed that and we have the correct code in there.
‫Anyway, usually when we sign up for any web application,
‫then you also get automatically logged in, right,
‫and so let's very quickly implement that here.
‫So log the new user in,
‫as soon as he signed up, okay,
‫and remember from the previous lecture,
‫how that works,
‫well all we really need to do,
‫is to sign a Jason web token
‫and then send it back to the user, okay,
‫but let's now first of all install the MPM package
‫that we're gonna use for everything related
‫to Jason web tokens.
‫So in our other terminal,
‫let's say MPM install, Jason web token,
‫so all of this together like this
‫and that should then install this package
‫and let's actually go ahead
‫and take a look at it at GitHub,
‫just to see the documentation
‫and let's do that here,
‫we no longer need this one here for now at least,
‫and so this will take us to the page on MPM,
‫and so you see
‫how popular this package actually is,
‫so we have 2.3 million weekly downloads,
‫so that really is a ton of downloads
‫and we can take a look at the documentation here as well,
‫but I personally prefer to do it on GitHub.
‫I think it looks a lot cleaner here,
‫and I'm so used to it at this point,
‫and so I usually just see it here, okay.
‫Anyway, the first functio that we're gonna use
‫with JWT here is sign, okay,
‫so in order to basically create a new token,
‫and for that of course we need the payload,
‫we need the key so that private secret
‫that I mentioned before
‫that's only stored on our server
‫and that we need to sign the token
‫and then we can pass on some options
‫and we will do all that in a second,
‫I just want to show the other function that we have here,
‫and that we really have a ton of options here,
‫for example the expires in,
‫which we're gonna use to use also,
‫so all of this stuff
‫and then we have verify.
‫So we also talked about the verification process
‫and that's basically implemented in this function, okay,
‫and so this is the one that we're gonna use,
‫when logging in a user, okay,
‫and that's really all there is,
‫so you have all this different options here, okay,
‫you have also decode
‫but that one is not really important, okay,
‫so you see that this package really only includes
‫the two functionalities
‫that we discussed in the previous video.
‫So signing and then verifying, okay.
‫So let's go back here
‫and actually start using the Jason web token package.
‫So let's import it here,
‫and it's usually simply called JWT
‫and require the Jason web token.
‫Okay, so lets create our token here,
‫okay,
‫and I'll like to simply call it like this so just token,
‫okay, then JWT dot sign,
‫and now the first thing is the payload,
‫and this is basically an object for all the data
‫that we're going to store inside of the token,
‫and in this case,
‫we really only want the ID of the user, all right,
‫so nothing crazy here, not a lot of data
‫that's not really important.
‫So we say that the ID is
‫and then we simply get the ID from the new user
‫that was just created, okay,
‫so new user dot and then remember that in MonogoDB,
‫the ID is actually called underscore ID, all right,
‫and so that is the object that's the data,
‫the payload, that we want to put in our JWT.
‫Next up, we need the secret, okay,
‫so basically a string
‫for a secret, all right,
‫of course this is a terrible one, all right,
‫this is just kind of a place holder
‫because actually, our configuration file
‫is a perfect place to store this kind of secret data,
‫so just like password for example,
‫and so let's go add and edit here, okay,
‫so let's call it JWT, secret,
‫and of course the name that we give here,
‫doesn't really matter
‫but what does matter is the secret that we specify here,
‫all right, because using the standard HSA 256 encryption
‫for the signature, the secret should at least be
‫thirty two characters long, all right,
‫but the longer the better actually
‫and this is where many tutorials out there fail,
‫some of them simply put a very short string here,
‫but that's not ideal again,
‫so for best encryption of the signature,
‫again you should at least use thirty two characters,
‫so I'm gonna create my secret here now
‫but you should really really use another one, okay,
‫please don't use the same one as I am doing
‫because that could become a security issue
‫for your application, okay,
‫always use a unique secret for your applications
‫and never the same, all right,
‫and especially not the one from someone else
‫so definitely not the one that I'm typing now.
‫So this can be anything,
‫it doesn't have to be weird characters or stuff,
‫I prefer to use a phrase like this,
‫my ultra secure and
‫ultra long secret,
‫so what happened here,
‫anyway this should be thirty two characters long
‫and so this is the one
‫that we're gonna use for my Jason web tokens,
‫but again please use another one, all right.
‫Anyway, let's go back to the authentication controller here,
‫and now actually use it.
‫So remember a environment variable
‫is process dot end dot JWT secret,
‫okay.
‫So at this point, we have the payload
‫and we have the secret.
‫The token header will actually created automatically
‫but now what we can also do
‫is to pass on some options,
‫and the option that I'm gonna pass in
‫is when the JWT should expire.
‫So this means that after the time
‫that we're gonna pass in here,
‫the Jason web token is no longer
‫gonna be valid,
‫even if it otherwise would be correctly verified,
‫all right,
‫so this is basically for logging out a user
‫after a certain period of time
‫simply as a security measure, okay.
‫So let's actually define that expiration time also
‫as a configuration variable here,
‫so JWT expires in
‫and so here of course , you can use the same time
‫as I am putting.
‫So we can use a special string
‫like for example 90D
‫and the signing algorithm will then automatically figure out
‫that this means ninety days, okay,
‫you could also use like ten hours or five minutes
‫or three seconds or something like this,
‫or just any number,
‫which will then be treated as milliseconds
‫but I think it's best to simply use ninety
‫or something D, so in this case, ninety days, all right,
‫and so again, after ninety days,
‫the JWT will no longer be valid,
‫even if the signature is correct and everything is valid.
‫Okay, so again just like an additional security measure,
‫okay,
‫so these options as always, we passed them in as an object
‫and then let's specify the expires in,
‫so expires in and then process dot end
‫and then JWT expires in, okay,
‫and this here will then add some additional data
‫to the payload,
‫but that's of course no problem at all.
‫So we just created a token,
‫now all we need to do,
‫is to send it to the client.
‫So let's put it here before the user actually
‫and then that's actually it.
‫That's really all we need to do to log in a new user,
‫because right now we're not checking
‫if any password is correct
‫or if the user actually exists in the database
‫because here in this case,
‫the user was really just created,
‫and so right away,
‫we logged user into the application
‫by sending a token, okay,
‫and the use of client should then in some ways
‫store that token, just as we talked about before
‫in the previous lecture, okay,
‫so let's give it a save here,
‫and let's actually try it out, okay,
‫so let's us my old address here,
‫hello@jonas.io, let's send it,
‫and let's wait for it
‫and indeed, here is our Jason web token
‫so congratulations, you just created
‫your very first Jason web token
‫which should look a little bit like this,
‫and of course it's not gonna look exactly the same,
‫because our secret is also not the same, right,
‫and now what I want to show you,
‫is the JWT debugger,
‫that I showed you as a screenshot earlier
‫in the last video.
‫So let's go ahead and copy this token
‫and then let's go to JWT.io,
‫okay,
‫then down here we have the debugger
‫and so let's delete this one here,
‫and put ours and right away
‫you see that our signature is invalid,
‫but that's because the sign function edits
‫these two properties here,
‫because we specified an expiration date basically.
‫So this here is issued at,
‫and this is expiration time, okay,
‫so if we remove these two from here,
‫you will see that now,
‫this signature is actually verified,
‫okay so what's important to notice here,
‫is that of course the header is visible
‫okay it's easily decodable basically,
‫and so you that we did not specify any of this,
‫it was the Jason web token package that did it for us,
‫but that here is actually the payload that we specified,
‫so if we take a look at this ID,
‫it should be exactly the same as we have in postman,
‫so ending on six OF,
‫and so indeed, it is exactly the same right,
‫okay, so these two here are open
‫and then the signature of course, we cannot really see,
‫because of course our secret is just that,
‫it's really secret, all right,
‫so this was just to show you that everything works,
‫and let's close this up,
‫and yeah, we're not able to log users in,
‫but only if the user just signed up,
‫because in that case, we do not need to verify
‫the email in the database,
‫and also not the password, okay.
‫So doing all that is a way more complex process,
‫and so that's actually what we're gonna do
‫in the next lecture,
‫so next up, we will actually log in users,
‫based on their email address and their password.