Hated every everyone that they share.
And in this video we're going to learn about the JWT not really learned because we have already worked
with the JWT in the past.
So it's now time just to simply go ahead and create the JWT tokens.
So for this one, first, we need to go into the DOT EMV because these are a couple of things which
would like to keep it absolutely as secret.
So the first one is going to be JWT underscore secret and this secret can be anything.
This is my JWT top secret.
Again, make sure the secret is always same.
And once you have added the secret into the database, Heroku or whatever you are using Digital Ocean,
make sure you keep this exactly same because if you are going to change this, your entirety of token
and everything is going to just go bonkers.
So please don't do that.
Now, apart from this, we're going to also have this JWT expire expiry and that is also going to be,
let's just say three days is enough for us, but it's up to you totally your choice that you want to
keep it the token alive for three days, two days, one day, maybe 24 hours, whatever you like.
I'm happy with the three days, so I'm going to go back up here.
Okay.
So next up is what do we need to create the JSON web token?
Of course, JSON Web token.
So let's go ahead and bring that up.
So we're going to say, hey, I am going to call you JWT, but you will come from require as JSON web
token.
So now the JSON Web token is here.
Now again, the big question comes in is what you are going to put inside this token?
My recommendation is usually just put the ID itself because anybody based on this ID can connect to
the database and query the entire user.
But again, if you think that this is much more feasible for you to have email, probably your application
is email centric and you want to just extract email from there.
Please go ahead and do that.
But my personal recommendation is always just enclose the ID and that's it, nothing more than that.
So okay, so this one actually is going to be a method for create and create and return JWT token again
the same thing, user schema dot methods.
And we're going to be calling this one as get token.
So that is really nice.
And let's call this one as get a JWT token.
Yeah, that makes sense.
Again, this might take some time.
Again, JWT doesn't take time.
My bad.
But if you make it a synchronous, that is also fine.
It's not going to harm anything.
But this is really a fast operation, so you don't need to worry on that part.
It doesn't take any parameter from the user itself.
User can just run it simply and get the token itself in order to generate the token.
We remember we do have two methods dot, sign and verify.
We use sign for creating the token itself.
Now in this first you pass on the payload itself.
So the payload is going to be the ID and this ID is going to be coming up from this dot underscore ID.
Now remember this ID up here, what we are seeing here is the field that we are creating.
So that is fine.
But this dot underscore ID is a field which is going to be given to you by the mongoose or the MongoDB
in general.
Whenever you save any data in the MongoDB, it automatically generates an ID field, just a side info.
This is not a JSON field.
This is a based on the field.
Again, coming back onto the main part, whenever you save anything into the MongoDB, it automatically
generates an ID for you and this ID field can be accessed by underscore.
ID always remain same underscore ID so it is not this dot ID, this is underscore ID.
So whenever you need to access that, you have to mention that in case you want to add more field.
Again, this really remains the same.
You go ahead and say email this, come on this, dot email and you can adjust access that.
But again, my recommendation, please go ahead and work on just like that.
Okay, so this is the only field that we have.
So that's nice.
Now we need to provide a secret as well.
So let's go ahead and as it says, hey, provide me a secret.
The secret is going to come up from process E and V dot.
Let's go ahead and copy that JWT secret, copy that and paste that.
I go ahead and put up a comma.
Now it says, Hey, once this is all done, you can actually go ahead and provide me options of something
like, which is expiry time.
Obviously we want to give that.
So let's go ahead and have this one.
This one is going to have this expires in again.
We want to control the entire expiry time from one file.
That's why we are having this one.
So we're going to go ahead and say process and EMV, dot, dot, and we'll bring it up from environment
variables.
So JWT expiry, there we go.
Now this helps me that whenever I want to change anything or something, I can just go ahead and do
it in one single file and that's it.
Now this is going to just create a token.
We obviously need to return it.
So let's just say return.
So anybody who says like something they shouldn't get JWT token he will be able to just get the token
right out of the box.
So no big deal.
No big issue there.
Okay.
So this is the basics of creating the JWT token.
I hope you have understood the exact same code, why we are writing it and interesting details as well.
Let's go ahead and catch up in next video.