Hey, did everyone.
They sure.
And welcome to another video.
In this video, we're going to see that.
What are the issues that didn't come up when we are trying to protect it out?
And what do I mean by protecting it out?
Let's go ahead and work on with that and explain you a little bit more onto that.
So so far we have understood quite in detail about the login and the register, but the point is what
is the use of this login register of course to protect some of the information so that only logged in
user can access that information.
Pretty obvious.
But how we can actually protect that, that is the big question.
So let's just say we have designed this route.
We're going to simply create a get route and it can be for getting the product information, maybe some
sensitive information like who has placed the order on your website or not.
That should be really personal to you.
And that all information may be is that dashboard.
So all of that and we really don't care right now how that information goes there.
But let's just say it is there.
As of now, we're going to go ahead and simply say that this is my request, this is my response, and
there we go.
So let's just go ahead and send this one here.
So red dots send.
Yes, I know we should be sending the resident status and everything, but now you are aware of that.
So I will not do that again.
So let's don't send and we're going to simply say welcome, welcome to secret information.
So that sounds great.
Okay, now let's go ahead and try to hit this dashboard route.
So let's go up here in the postman and we're going to go ahead and remove all of this and we're going
to say dash dashboard.
There we go.
And if I try to go ahead and hit the get root on this one and send this one, we get this information.
Welcome to the secret information.
So what is stopping me to actually go ahead and get this route?
Nothing.
Honestly, nothing is stopping me right now.
And that's where this login and register actually comes in, because if the user is already there,
I can actually log him in and once I log in him, that's where the our token actually comes into the
picture.
So let's go ahead and talk about this token.
And also I would like to talk about a little bit of the strategies that can come in, because when you
go ahead and try to use this token, there can be a lot of places where you can place the token as frontend
engineer and you can expect that into the back end.
So let's go ahead and work on with that.
So first, how you're going to protect that out.
Remember we talked about the middleware that something happens and after that something happens.
Yes, that's exactly is going to help us to protect the route.
So this is the strategy that we are going to follow.
First, to use the middleware, of course, we don't know right now how to use that, but yes, we can
use the middleware.
So how we're going to do that is we are going to learn how to write the middleware, super easy to do
nothing more than just a function.
Then in that middleware, the functionality that we are going to build in is first check for the token
presence.
Now this in itself is a really complex thing that you have to figure out that whether you are going
to support the mobile app or just the web app and maybe in the mobile app, 40 are supporting Android,
iOS, Flutter, React Native or maybe something else.
Because based on what the framework is, you have to see that where that token can goes on.
I will come back onto this point just in a minute, but first, let's go ahead and work with that.
Suppose somehow you have grabbed this token, now it's time to verify that token.
So JWT allows you to verify that token that whether this token has expired or it is is still authenticated
or is it generated using your secret only since you only know the secret and you have generated that
token, only you are able to decrypt that token and get the information from it.
Now, apart from this, once you have extracted the token and verified it, then go ahead and extract
the information from the payload.
That's very interesting thing comes in now.
Once you have extracted this information, maybe at the time you are just grabbing the ID, then you
are again making a request to the database itself, grabbing more information and putting that information
somewhere.
It can be anywhere into the request or whatever that is.
And once that is all being done, then you make sure you don't forget the next.
Now coming back onto the part, check for the token presence and extract that token.
So this is where a lot of things comes up boiled based on the mobile and the web.
On the web, it is super easy.
You don't have to think too much majority of the time.
Let me introduce you a couple of places where you can put up.
Definitely there can be more.
The first one is just send the token on to the front end, how that frontend guy is going to deal up,
that's up to him.
But we also need to make sure that information is passed on to the front end engineer that I expect
that whatever the sensitive route you are trying to access, you give me that token there.
This is where the cookie comes in.
So majority of the time what I prefer is to set that token token in the cookie itself.
And we saw that in the express that I can access the cookie directly from the backend itself.
Resident Cookie So that's it.
Now I prefer to use HTTP only cookie in the production because the HTTP cookie is only accessible programmatically
by the backend.
Only frontend cannot access this cookie.
If you send just the cookie, it can be accessed by anyone.
But if you just send a flag http only, it can only be accessed by the backend.
Another one of the thing is you can expect that in the headers which is.
A common information, so common that I can show you that in the post man itself there is a form of
headers and you can just pass on this up here.
And not only that, in the post we are going to see there is authorization tab and you can just go ahead
and select your beta token and pass on the token here as well.
So there are a lot of places where this token is supposed to go there.
The reason why Postman is having this, because it is a common thing.
Everybody does that.
And also you can expect these tokens in the body itself.
Now, one thing more I would like to add in more on to this one.
Sometimes there is a strategy.
Also, this is not a front end course, but just to give you more information, sometimes you will see
that while sending the request you don't send any token, but there is usually a place or an important
file in which you actually kind of take that request in between.
Axios is completely able to intercept that request, and while sending this request just before that,
you just add the token into the headers itself.
Now what you are going to name this header that's totally up to you and the communication that you are
making.
So if you are using the bearer token, just name this as token and just add a bearer and space.
And then the token you just grab that and in case you are sending it up in the header, make sure you
know what you are calling this headers body is very, very rare.
I haven't seen that but yes, in one and for one sensitive.
Not sensitive in one of the cases I've seen that yes, it actually came into the body itself.
But again, the communication is really important between you and the frontend developer.
That way I do, I accept or expect my token.
So this is all what we have grabbed so far as the basics.
So now we know that we have a route that we need to protect and the token is playing a very important
role in that.
And we can place the token in the cookies, in the headers, or we can just send the token and he can
make that token in the every request.
So there are a lot of places to worry about.
Okay, so that's the basic information.
In the next video, we are going to write our own customised middleware that can actually perform this
exact task.
Let's catch up in the next video.