Hey, did I run that this year?
And welcome to another video.
Now, so far, we are doing absolutely fine.
We are able to send the tokens even.
We are able to intercept the token in the order itself and it's going good.
We have protected our routes as well.
But now I want to discuss a little bit more and would like to introduce you some of the errors that
we have already introduced in the code.
Yes, some of you might have figured it out.
Some of you might even have a thought about it.
But yes, there are some of the issues in the code that I will walk you through.
Even in the auth file, there is a slight issue which you won't be able to see.
Even you will not get that bug right now, but it's important.
So what we want to do next, so far I've taught you that you can send that token using the beta open,
all of that.
But now I want to introduce you that how you can send the token in the cookies itself.
We haven't discussed that and that's an important aspect.
But remember, just please remember or take down the note of this one that this cookie is only valid
for anybody who is consuming our application on the web itself, which is the browser.
If you are going to send these cookies in something like React Native Application or Flutter, it is
another of the nightmare in those applications.
It's better to send those token itself and whenever the request is being made, it's it comes up as
an header in the authorization beta set.
So that is what we are going to be doing in this video.
So let me first introduce you to the postman so far.
If I just go ahead and send the login request, it gives me a token back.
That is fine.
But if you check out the body just near the body, there is a cookie section where all the cookies,
if something is being set, they can actually come in up here.
So let's go ahead and work out with that.
So first, I'm going to go ahead and work on with the app and I will go up into this login route.
And we have seen that this is how we can send this one.
Now, let's just say that I don't want to use this JSON sending format.
I would like to rather set up the cookie.
So I'm going to go ahead and write a comment for you if you want to use cookies.
Okay.
So how do we use cookies?
And actually that's fairly easy, not that much stuff.
First, what it requires is the option.
So let's go ahead and create the options.
And options can be as complex as you want for the cookies.
We are not going to go that much of the complexity.
We would rather like to keep it absolutely easy.
The two major thing that you're going to see in the cookies itself is first, when the cookies are expiring
and are the cookies only readable by the back end only.
So let's go ahead and do that.
It's really easy.
So in this one first we are going to go ahead and say expires, expires.
There we go.
So.
Expires.
Come on.
I can write that.
There we go.
So what, this expired.
Does it actually ask you to give us a date when the cookies are going to expire?
So there are a lot of formats.
You can check them online.
I'm going to go ahead and use a simple format of providing a date when this cookie actually expires.
So I'm going to go ahead and say that, hey, first use date.
Now, this is going to give us the exact current date.
And then on top of that, I want to add, let's just say three days or two days, whatever you like
to go.
I'll go for three days.
So all I have to do is three and then multiply it by day and then multiply it by a minute and then seconds
and then finally thousand.
So this is the syntax.
And no, I'm not making this up.
This is really weird, but that's how the cookie expires.
Option works on.
I would also like to add another of the property up here.
So I'll come up here and I will also say that HTTP only is going to be true.
Now, as soon as you mark this flag up, what this will do, it will allow the cookies to be read only
by the back end server, not anybody or any script in the front end itself.
But we will be able to see that in The Postman, because that's how it is designed for the postman.
Okay, now it's time to just go ahead and send this up here.
So notice we are not sending the status just like that, we will be sending a cookie in this case.
So how do we do that?
It's actually super easy.
We go ahead and say rez dot status.
So first raise the status.
I'm going to go ahead and say it is 200 all good.
And then I can go ahead and say cookie, not cookies.
It is cookie.
So the cookie that I'm sending up is going to be token y token, you might ask.
We can can we name it anything.
Yes, you can name it anything as you like.
But in the middle, where I'm expecting that the cookies is coming up in the name of the token, that's
why I'm calling it as token itself.
Okay.
What are the other parameters I have to pass on?
What is the value of this cookie?
So the name is token.
The value is token itself, of course, and then you pass on these options.
So there we go, nice and easy.
Now, further down the road, if you want that, probably some application might not be handled, be
able to handle this cookie.
So in top of that, I'll add a JSON response.
And in the JSON response, I'm going to go ahead and give it simply a success of true, because that's
how maybe we are designing the application like that.
If I can get that properly, that would be awesome.
So success is true and maybe we also want to send the token as well and maybe for some reason we want
to send the user itself again.
It's up to you how you want to send that.
Now, this is not going to work.
Let me save that and show you a couple of reasons why this is not going to work.
So we have changed the route, the log in this time.
If I go ahead and hit the send here, notice it says, hey, there is a token being given to us and
we are going to get all these information.
And in the body itself we are receiving all the data.
So this is nice.
So we were able to send the cookie from the backend to the front end and this cookie is getting stored
in the browser.
We can see the notice here, the token we calling it as token, the value is there.
You cannot actually go ahead and use the backspace or change this token because this is not accessible
by the front end.
And we we are telling that when it expires and this is http only.
So this is all good, this is all nice.
But the problem actually starts when you try to read the cookie itself and probably there is some header.
Okay, so it looks like this is not much of a big issue of the headers.
I'll set it up probably later on.
Not much of a big issue right now.
Moving on to the part where things go wrong.
So how we're going to go wrong this time that obviously now we need to access the root, which is the
dashboard.
This is where the problem actually are going to kick in, hopefully.
Okay.
So let's go ahead and see that if now we have the cookie and we have written the auth that hey, look
for the token in the cookie itself, we are not sending it in authorization, we are not sending it
header, just collect it automatically from the cookie itself because you have set it up there.
Now let's go ahead and send this one and we are not able to receive anything inside the body.
It says error.
So why?
The error is coming in?
The error is coming in because something is wrong, obviously.
Now let's go ahead and try this out, that how this is going to work.
So in the outset, I have actually tried it a little bit, but I'm going to go ahead and try this again
for you.
So what I did is if nothing is working, obviously the first step is actually to go ahead and log that.
So we're going to go ahead and say, I want to request cookies.
So all the cookies that are coming in, I want to see that what is coming in, because I'm trying to
extract the token from here.
I can see in the postman that the token was there, but I'm not able to see that.
And the reason is really simple.
If I go ahead and send this dashboard and I look for that, it says, Hey, this is undefined, so that
means your cookies are not coming in.
Y You might be guessing in such case.
Go ahead and look for the middleware in this case.
Again, just like we have expressed JSON which was given to.
US by default, we were able to read any JSON data that was coming in.
Without this, you wouldn't be able to read the JSON data.
Similarly, for cookies, you cannot actually go ahead and read the cookies directly.
Now you might be saying, hey, can we write express dot cookies like this?
I wish.
I think we should be able to write this, but that's not the case.
I wish Express could give us, just like they have given us JSON, they should have given us the cookies
directly.
But sadly, that's not the case.
In that case, you have to look for another package which is known as cookie parser.
Again, by looking at the weekly downloads, you can see that how crazy, insane, popular this package
is.
I think express guys should design something of their own and should work like that.
So let's go ahead and copy this and we will go back and we'll kill this up and we'll install this one
up as cookie parser and there we go.
Cookie parser is they're up and running and all we've got to do is really simple.
Look into the documentation.
It says, hey, just bring in the cookie parser like this and then use this as a middleware to say AB
dot use.
So pretty easy, very, very standard.
I'm going to go ahead and say, hey, I'll introduce you here.
And then once I have this one, I'm going to go ahead and say, hey, now I want to use this cookie
parser.
And just like we were able to use file, upload and all of that, it was giving us files.
This time we will be able to get resident cookies.
So once this is installed, let's go ahead and try to hit the route again.
So I go ahead and say hit that we are still getting error, but that's not to worry because we are now
we can see that we are able to grab the token.
So see we are able to grab the token.
But still we have got one error which I'm pretty sure most of you have ignored, but I have deliberately
introduced this one and that's why this video is here.
So this says cannot read the property replace.
Why is that?
Since you are getting the token, why are you having this replace of undefined?
Now this comes where the classic JavaScript kicks in.
So in the old section, if you notice we are saying, hey, just go ahead and first try to grab the
token from the header.
Whatever you grab, you just go ahead and run replace on that.
So we are instructing that whatever you grab.
I didn't say if you grab something or if you grab undefined on all of that.
It is trying to just run this method which is replace the beer and that's why it is creating a problem.
So in case you are chaining of these things, then obviously things should go bad.
Now in the case that if you want to grab the token itself, just go ahead, we can move on and we can
say that, hey, I want to grab the token just like this.
So go ahead and cut this out and we're going to go ahead and place this first.
And let's go ahead and use the pipe here.
Remove the pipe from here.
Now, what is happening in this case?
In this case first is trying to grab the token and rest of the codes are again working after that.
Now, since it's not any grabbing, any headers and all of that, it will still try to run this because
it's an odd statement, but this will not give us a problem because the token is already being set and
there is something inside the value.
In fact, this request had a better setting.
Usually in the production you are going to see that this is written at the very end of it.
So let's go ahead and cut that and all of your packages that you are trying to write.
Just make sure you go ahead and place them at the very end.
Replace this one also.
There we go and remove this one.
There we go.
So remember, it's not a problem, it's not an error, it's just how the JavaScript functions.
So first we are trying to grab it from the cookie, then we are trying to grab it in the body.
You can also grab it from the params or any place else that you want.
And then after that we are trying to grab it from the header itself.
Looks like I'm having a bit of an itchy throat anyways.
Let's go ahead and see now if we are able to grab all these things.
So let's go ahead and try it one more time and I go ahead and I'm able to extract the information this
time.
So this is quite a lot.
But you know, you have understood quite a basics of it and by this point you also now know how to handle
the cookies so you can send the token in multiple ways directly in the JSON and the cookies, and there
is more.
Now there is a small assignment for you as well.
I've showed you that how you can set the cookies and we can see that the these cookies are going to
expire on Wednesday 20th and today is 17 October.
So it's going to take three days itself.
Now, I want you to design a simple functionality in which we will again hit the same route, which
is going to be the log in itself.
I want to expire these cookies, so go ahead, read on the internet that how you can expire the cookies.
You're going to find a variety of methods and I want you to implement at least one of them.
Click a photo that how you applied expiration of the cookies or aka expiration of the token.
Go ahead, click a photo tag on Instagram and I would love to see that how you have researched it on
the Internet and how you came up with the solution.
Let's go ahead and catch up.
It makes video.