‫Welcome to the last video of this section.
‫And in this one, we're gonna be
‫preventing parameter pollution,
‫using yet another NPM package.
‫But before installing that package, let's go ahead
‫and take a look at the error.
‫But before doing that, let's head over to Postman
‫and see why we actually need
‫to prevent parameter pollution in the first place.
‫So, first up, we need to log in.
‫Okay, so, with this user and this password.
‫So now we can use the Get All Tours route.
‫All right, and so what I'm gonna do now here
‫is to add some parameters to the query string.
‫So let's see, I want to sort by duration,
‫and at the same time, I also want to sort by price.
‫And it doesn't actually make much sense right
‫because we're prepared to only have one sort parameter.
‫So let's see what we actually get with this.
‫And indeed we get an error saying that this
‫.querystring.sort.split is not a function.
‫And so that's happening in the apiFeatures.js in line 23.
‫So let's open that
‫and so here, on line 23 is where that error occurs.
‫So it's trying to split the sort property here,
‫which we expect to be a string.
‫But right now since we defined it twice,
‫so sort once and then sort twice, express will actually
‫create an array with these two values, duration and price.
‫Let me actually show that to you.
‫Console.log.
‫Now I'm copying it.
‫Okay, try it again.
‫Here's the same error and as I said it is actually
‫an array with duration and price.
‫And so that of course, we cannot split
‫because split only works on strings, okay?
‫And so this is a typical problem which attackers
‫can then make use of.
‫All right, and so basically we're now going to use
‫a middleware which will simply
‫remove these duplicate fields, okay?
‫And that one, let's install it.
‫It is called HPP which stands for
‫HTTP Parameter pollution.
‫All right.
‫Let's quickly require it here.
‫All right, and so, this is yet another very simple one.
‫All we need to do is app.use and then call HPP.
‫So, prevent parameter pollution.
‫And this one again should be used here by the end, okay,
‫because what it does is to clear up
‫the query string, all right?
‫So let's try that again.
‫It's taking a bit of time, and here we go.
‫So the error is gone
‫and so now it's only using the last one.
‫So it's sorting my price now and indeed we start
‫with the lowest one and then moving up 497,
‫all the way to the most expensive one
‫of almost 3000, all right?
‫So that's kind of fixed but we actually want
‫some duplicate properties or fields in some cases, right?
‫For example we might want to search for tours
‫with the duration of nine and five.
‫So remember that in our API, we can do this,
‫so duration equals five, and we can say,
‫at the same time, duration nine, okay?
‫And we want this actually to work but right now it doesn't.
‫It only finds the tour with nine days, right?
‫But if we hadn't, or HPP middleware.
‫So let's deactivate it.
‫So if we didn't have it active,
‫then we would find three tours, one with duration five,
‫then here with duration nine
‫and here another one with duration five.
‫Okay, and so in this case,
‫this is actually the expected behavior.
‫So what we can do in order to be able
‫to use the middleware but still get this result
‫that we expect here, with the duration,
‫we can white list some parameters, okay?
‫So into this HPP function, we can once more pass
‫an object and then in there, specify the white list, okay?
‫And the white list is simply an array of properties
‫for which we actually allow duplicates in the query string.
‫Okay?
‫And to duration is of course one of them, all right?
‫So, let's try that again.
‫And so, right now we still get our three results as before.
‫But if we tried it with sort,
‫and let's create a new tab here.
‫So if we tried it with these double sorts,
‫then we should also get no error.
‫Well now were not logged in,
‫so let's just get our error token here.
‫Try that again.
‫And now indeed it works, we get no error.
‫And so that HPP middleware is doing it's job.
‫All right?
‫Also close up this one, and now we should also
‫specify some other fields in our white list,
‫because for example we want to search for this one as well,
‫or the ratings quantity.
‫And so let's just copy all of them here into our white list.
‫So the average as well.
‫Then also duration we already have,
‫and let's say max group size.
‫We might also want the difficulty.
‫And also the price.
‫And I think that should then be enough.
‫All right.
‫And it might seem a bit weird to basically manually
‫put all the field names here and later we might
‫have to do the same thing for the other resources,
‫and that will then make this white list even bigger, right?
‫And of course we could do some complex stuff
‫here in order to get these field names
‫from the model itself, but once more,
‫I just want to keep it simple here, okay?
‫And so I'm just manually defining these field names here
‫and then call it a day, all right?
‫Okay, and that actually wraps up our authentication,
‫authorization and security section.
‫And if you wanna have some more fun with it, then of course,
‫you can try to implement some of the stuff
‫that I suggested in that summary video
‫that I showed you before with that slide
‫with all these different security measures
‫that we already implemented and some of which
‫I told you to experiment with.
‫So feel free to do that, or if not,
‫well then let's just together move on to the next section
‫which is gonna be a really exciting one again
‫because we will then really start modeling the data
‫and learn some more really advanced MongoDB stuff.
‫So I can't wait to see you there.