Hey, did everyone share?
And welcome to another video of writing documentation.
So in this video we'll talk about the security schema.
Now, if you'll be working on to a complex project, it is obvious that you'll be writing some of the
protected routes that require some of the tokens in your browser.
Now token can be into the header can be into the cookies.
It's a whole lot of flow that you can work on and definitely we can have our argument which one is better,
which one is secure, and all of that.
I'm up for the debate, but not right now.
So let's go ahead and see that how this actually works.
Now, a couple of things that you have to keep in mind.
That first thing, that info is kind of a general collection of all the things that you put up in it.
Similarly, we have servers, we have components and we have parts as well.
So this is how the entire breakage is being done.
Now we are aware of the server.
We can actually go ahead and close it down and move on further.
Now when you're closing it down, make sure, especially pay attention where your cursor is blinking
because this matters a lot.
Notice here, if I go ahead and close it up and if I try to go enter, this is how it happens and it's
going to mess up everything.
So please pay special attention on this one.
You might want to hit a couple of lines of enters after this and you go ahead.
And now shutting this up really very obvious.
But I know I have seen people struggling it up even in the offices.
Okay, now moving in, then we are going to define a component and no extension is going to give you
suggestions on this one.
So please don't expect once you have written a few of the documentation that will start giving you that.
Okay.
Now, after this, we can define our security, if I can write that.
Security schema.
Now, these security not schema security schemes.
And I'll tell you from where you can actually copy paste this so that you don't make any typos but will
at least try to write down them.
You can define security schemes and swagger actually knows that it can come up from the cookies, maybe
from someplace else.
So it provides you a whole lot of options to actually go ahead and win that.
So one of them really common one is actually the cookie auth.
So your authentication can be made by cookies, probably http only cookie, but some form of the cookie.
Now in that we allow a type, this type is going to be API key and again, case sensitive.
Yes, it is case sensitive here.
So make sure you pay attention up here.
Now in here we are going to say in and just like that we are going to say it is going to come up in
Cookie and we are going to also name this one as well.
So let's go ahead and call this one as token.
You don't need to specifically name this one, but it would be easier and I'll show you later where
it actually comes up and all of that.
Let's go ahead and save this one and catch it up on the browser.
So how it looks like.
So here is my browser hit reload and there we go.
Now this authorized Tab's tab comes in and if I click on this, it gives me that, hey, this is the
name of this cookie, so token.
So it will come up in the cookie and whatever the value you paste it up here, it's going to come in.
So this is how it basically works.
Now I have given you this link in the presentation itself.
This will take you up to this basic structure if you'll go a little bit up here into the parameters,
not here, let me just look for it.
So in the authentication here, you're going to see that all of these are mentioned and again, make
sure you read it a little bit because sometimes you might want to use some of the JWT or something else.
So they have given all of this up here.
We wouldn't be using all of that.
Let's go ahead and place the bearer token as well.
So in case maybe majority of the time you'll be using the JWT tokens for that, the syntax is this one.
So let's go ahead and add this one.
Now, as soon as you add this, this is the exact point where a lot of people make mistake.
Now, all of these are very, very case sensitive.
So pay special attention on this.
And there we go.
Now, this is how the structure should look like.
Save this moving back and let's go ahead and hit a reload.
And now if I authorize, I have option to pass it up in the cookie or I have option to pass it up as
a beta auth, which is HTTP beta will be all placed up and you just have to pass on your token value
or whatever the value you want to pass on.
I can as of now.
Right, just the test and authorize it and you can see the value is being stored.
Now, all the requests that you are going to make, they are going to be done with this information
being passed on in the headers, but you can also manually pass on some information.
We will study that later on.
But notice yet if I reload this one, I click on authorize and that value is gone.
This is by the design of swagger.
So this is not a problem.
This is how swagger works.
And not only this, if you go back up here onto the authentication section, we have this API key auth,
maybe are designing some kind of program or an application which is restricting people or how many times
you can use the APIs or you can hit the request of the servers.
So in that case, you can just go for these APIs in the header and you can do all this stuff there.
So make sure you read a little bit about that.
And notice here again, we have these security schemas and all of that.
What is allowed, what is not again, there is no escape from reading the docs.
You can I can just only point you can address some of the critical issues, but you have to go through
and read through them.
This is all that you need, at least for the most basic level.
And I don't think you'll be needing much more than this for majority of the cases.
So that's it.
Let's keep the video short.
And this is all what we wanted to cover about authentication.
Let's go ahead and move on in the next video.