Hey, did everyone they share?
And welcome to another video.
This is also an important part of whatever you'll be building up later on.
This is going to stand as an important part of that entire structure, this video that tokens.
Now, a lot of people get afraid by the term of token.
They think that token can be break.
It's not secure and all of that.
This is not like it.
Tokens are arguably very, very secure.
All the awards, the Google sign in, the Facebook sign in, almost all of them provides you the token.
They are also using tokens as their internal infrastructure.
So it is comparatively very secure.
You cannot make anything else 100% secure.
But all of the standard companies, every website that you see, majority of them are using token now
how they are using the token further down the road.
That is important structure and there's a lot of argument and debate we can have.
Don't worry.
I'll I'll tell you all the possible scenarios that can happen and we'll have a debate on this later
on as well.
So treat your token always as your car key and consider your car is being parked somewhere in the remote.
So anybody who has this car key can actually claim the authority that this is my car.
He is not the proper owner.
He doesn't have the documents and everything.
Yes, I do agree on that part, but he's having the keys right now.
He can open your car, he can actually drive it.
So treat your token very, very carefully.
Now, as a user, they don't have much of the option to treat them as securely as possible.
But as a developer, it's your responsibility to treat them as secure as possible.
So make sure that you treat them as as as carefully as possible.
Now, also, make sure that you expire the token.
This is really a great functionality that is there and based on an ideal time of what your application
is, is it an educational website?
Is it a social media, whatever that is, the token should always and always expire and when the user
logs in again, he should get a new token or a new token one here.
So expiring the token, it can be two days, seven days, 24 days, whatever you like, but it should
expire somehow so that it's if mistakenly or by some attacker, he gets the token that is somehow being
just kind of a dumbed down after this amount of time.
The important question is how this token is made.
Now, this token is actually a three part of the sum, the first one being header, the second one being
payload, and the third one being signature.
Now, don't you worry, I'll explain to you what all of these are.
But the important part is in the payload now token is generated based on some information that that
token is carrying around.
So that information literally is inside the token.
When you are going to decode that token, you will be able to extract that information and know we never,
ever pass the password inside the these kinds of payload.
We usually go for only email or probably at a max, something like a request ID, so that from based
on that ID, we can retrieve all the information of the user.
So that's usually the flow.
But what are these signatures and headers now?
I can definitely show you more of the things in the presentation itself, but the website has done so
much of a good job that I will actually say that click here, swipe up whatever you say and we're going
to go on to the JWT website.
So yes, JWT are the tokens also known as JSON Web Token.
So first we're going to start with introduction.
So what is the JSON Web token?
It actually is a standard way, self contained way to securely transmitting information between the
parties.
So in this case, we are just saying we are using some signature to pass on a trust in this case that
yes, you are the user who we are claiming to be.
So somebody says when you should use the JSON web token, you should use it for authorization and information
exchange.
So both of them we are doing information exchange means we are allowing user to create something on
our database and authorization that we are only allow him to log in and all of that.
So these kinds of things are being used and they are mentioning up here openly.
So what is the structure of this token?
It is actually the header payload and the signature and that's why it always looks like this.
So what comes into the header, maybe what type of algorithm we are using and there is no shortage of
choosing between the algorithm.
You can make it even more complex for that.
And then the payload, whatever you want to send, that's the payload.
It can be really something like this.
The name admin.
True, and more information that you can extract directly from here signature.
Again, there is no shortage of signature.
By default it uses an SHA 256, but you can go ahead and change that.
So this is the mixture for 256.
Really, really one of the security algorithms so far open source, kind of open source and it is not
being broken yet.
So that's why we are using it now.
This is how it looks.
And by the way, you can go on to the home page and can see how your code and token is going to look
like.
So this is how the token actually looks like.
I know this is a really big string.
That's how it looks.
So the header something looks like this.
The great thing is the library that we are going to use, we don't have to pass on all of these.
We just pass on that what kind of payload we need to carry on and of course the expiration information.
But that is also even optional.
So we can go ahead and do that.
Importantly, note down this simple warning here.
JWT is our credential.
Remember this always.
I'll repeat myself.
JWT is our.
Credentials.
Treat them as password, treat them as keys, which can grant access to the resources.
So treat them almost like password.
It shouldn't be handled lightly.
So how are we going to use that?
That is the big question.
And that's what we are going to do exactly in this video.
So I go ahead and search for that.
Hey, I'm looking for a JSON web.
Is it going to give me?
No Jason Webb token.
I hope now it gives me something.
There we go.
So we can see that we have Jason Webb token.
There are a couple of other implementations as well.
We don't want to go with that.
We'll go just with the basic, which is JSON Web token.
So look for it.
There we go.
And I hope you can see the weekly downloads here as well.
Pretty insane again.
So we'll be using the Jason Webb Tech token.
The usage is pretty simple.
You just use the JWT sign to sign the token and then we simply pass on the payload secret or private
key.
And then there are a few options and callbacks that possible.
In case you want to use it, you can use it.
You can also go ahead and define your algorithms, most importantly in the options you can pass on the
expires.
And some people prefer to change the algorithm.
I don't I totally trust the has to 56, so I'm going to go ahead for that.
So you can pass on the two days, 10 hours, seven days.
This is the format, what you can pass on.
You can even give the 62nd or something, which I wouldn't be doing that.
That would be unnecessary and wastage of the time.
Now looking up back a little bit onto the scrolling up here, notice we are able to sign.
But what I wanted to show you a little bit further down the road in the documentation here is you can
actually use JWT to verify again the same point.
We just don't want to encrypt something.
We also want to verify after the encryption so we don't have to decode it.
We can actually go ahead and use verify and some of you might be asking that why don't we use the same
JWT to encrypt our password as well?
No, that's not how it works.
That is actually a bad advice.
So please don't do that and don't even have that question.
So we can actually go ahead and decode.
Once you actually decode this, then obviously I'll show you what the code actually gives you as the
information.
Basically, your payload is being extracted when you decode the information.
So rest we can actually talk about as we move further down the road.
So let's go ahead and copy this.
And now you understand fully that why we are doing what we are doing, let's go ahead and have the JSON
web token, pretty simple and small library.
So let's go ahead and run the dev mode again.
Okay.
First thing as you all know that how we're going to go work with that.
So let's go ahead and just below the script or whatever you like.
Let's go ahead and call this one as JWT as the documentation says.
But again, this is not compulsory.
Feel free to call it even Superman.
So let's go ahead and say require.
The not request.
Come on.
Require.
There we go.
And we're going to say JSON Web token here.
It is important to write this in Web token because it is a library that is being installed.
Once this is being done, how we're going to create the token that is really the simplest and the easiest
way.
So once our user is being done, remember we have first created the user.
It's not like we are saving that information onto this entirety of the thing into the database itself.
We haven't done that yet.
So I'm going to go ahead and say, hey, user dot token.
So I'm using the model to generate that.
And the first, let's go ahead and create a token before even saving that we haven't created yet.
So I'm going to write a comment for myself.
Token creation part goes up here, scroll it a little bit.
Okay.
So first let's go ahead and hold this token into available.
That's important as the documentation says, we can just use the JWT dot and I can go ahead and sign
the token and I can later on verify that as well.
And I told you, you can just go ahead and create a token like this, but there is no point of creating
the token like that.
So the first thing that we're going to define here is the payload.
And I can go back into the documentation to show you some of the stuff that how this is being done in
case you forgot that.
So there we go.
So notice here, this is the foo and bar, this is actually the entire object which is acting as a payload.
So this is the most important thing.
So let's go ahead and work with that.
Then we go ahead and mention a private key and then we won't be passing algorithm.
We would be rather passing on that when it expires.
So let's go ahead and work on with that.
So first thing that we're going to do is let's go ahead and pass on.
So as soon as you save any value inside the database, Mongoose or in general, MongoDB actually gives
it a unique object ID and that object ID we can access by this variable user.
And that's why we have created this and are holding that into a variable.
Otherwise that simple user is just fine.
We don't need to hold the reference somewhere, so let's go ahead and work on with that the way how
we access it inside the database is saying whatever the object name and then the property name is.
Underscore ID a little bit weird, but this is how it works on.
So we're going to call this one because this is dot underscore ID is a little bit weird to me so we're
going to go ahead and say that I want to hold this into a variable.
So I'm going to go ahead and say call this one as user underscore ID remember this always this is the
reference of the variable that this is what it has created and given me back the same user.
So this user dot underscore ID is something that's coming up from the database itself.
I found it a little bit weird to call it as DOT underscore ID, so I'm just renaming it as user underscore
ID.
You can just call it as it is as well.
Now further down the road, just to show you all that we don't need it, but you can go ahead and store
other information like email as well.
What are the email we have passed on here so we can go ahead and you can also here say user dot email
as well in case you want to extract it from the base itself.
But this email and this email are just the same.
So I'm going to go ahead and do that.
Now comes up the information that is the private key.
What is this private key?
Now, this private key is really, really important because based on this, your token will be generated
notice.
It's a it's a secret or private key.
Now, since this is super important, that's why you are going to see that everybody just say this is
a secret key.
And this secret key is entirely being used in all of throughout the application and you can name it
as anything.
This is my ae key.
You name it, whatever you like, it doesn't really matter.
You can make it more complex or something, but I like to keep it a long string with all the capital
letters and all of that.
So it's a combination of that.
Okay, once this is being done, now I can go ahead and access that.
In order to access that, I can hold it into a kind of a D structure that just like we have done in
the past, or I can just go ahead and say directly process E and V dot, it's always better to copy
this because I make a lot of typos.
Okay.
So the private key is also being passed on and now the final thing is passing on an object.
Now this object can actually store it if you want to change the algorithm or you want to just process
that when this should expire.
So I'm going to write the only one which is expires in and mine is going to expire in two hour, which
I think is a good enough time.
Okay.
Now this token is being created, so this whole part is being done.
The token is being created now since my model actually allows me to simply say user dot token, I'm
going to update that by saying simply token.
Now, am I going to update this into the database as well?
That is totally a strategy.
Update or not, maybe you want to store that something into the database itself.
You can again go ahead and save this into a database.
And if somebody tries to access any resource, you can take that token.
And even before kind of verifying that token, you can say that whether there is any token already existing
in that user's property or not, otherwise you can just simply deny him.
So again, there are a lot of strategies that can.
And people can debate all of that.
So once this is all being done, now this user that you are having is having a lot of information.
So whenever it gives you back, it gives you all the information.
So first name, last name, email, password, everything is coming back.
So we need to take care of that situation as well.
And we will be doing that, but not in this video.
I wanted to show you more of that.
Okay.
So what we're going to do is simply resort status and the status is 201 because something has something
new is created, and then we're going to simply use JSON instead of saying resort send and we're going
to just go ahead and send this entire user to at least see that what is going on all about it.
Okay.
So this is a lot of stuff that is happening up.
Quite a lot of stuff actually is going on.
And notice here we are doing all of this and we are not using the promises here.
So this is also going to create an issue.
Now, what we need to do is we actually need to wrap it up inside the Try and Catch blog.
I should have done that earlier.
But again, this is the common issue that I will address in the next section.
So I need to go ahead and cut all of this and wrap it up around the Try Catch blog, even the sending
part.
So let's cut this up right now.
This is how it looks like.
So I'm going to go ahead and say try catch.
And this whole thing goes into the try and if anything goes wrong in the error, so we are going to
go ahead and just let just console.log it.
We are not handling handling the errors as of now, but we'll have a separate section on that.
So let's go ahead and log this.
And we're going to just drop the error.
Again, just a quick reminder why we are using try and catch because all of this information of and
all of this should either be happening into a promise.
But since we are not using the promise, that's why we are using try and catch, which is at least one
of the safe way.
There is still one issue remaining up, so we're going to go ahead and fix it up.
This is update or not in DB.
Is totally for you as a reference.
And there is another to do here.
So I'm going to go ahead and mark this one to do handle password situation.
Still, there is a situation on the password.
Come on.
There we go.
So, yes, there is a password situation.
I'm fully aware of it, but I'm not going to handle it without showing you what the problem actually
is.
So let's go ahead, move in the next video.
Now, our at least the registered root is complete.
Let's test that.
And after testing it, let's see what situation we are in and then fix it up.
Let's go ahead and catch up in the next video.