Hey, did everyone.
They sure.
And welcome to another video.
In this video, we're going to talk about how we can create a forgot password token.
Now, let me break it to you.
The token literal meaning of the token is something which actually encapsulates some of the information
like user ID, expiry time and a whole bunch of things.
In the technicality, that is considered as token in the case of forgot password.
This is not really a token.
This is just a random string.
Yes, we do call it as a token to call it or to sound a little bit more complex.
But in reality, it's just a string that you have stored in the database itself and you are sending
it to somebody in the front end as well.
So this is really the most important thing.
Now let's go ahead and work on with that.
So what we're going to go ahead and call this one is simply to generate, generate, forgot password.
Token.
But I'm going to go ahead and write this into the bracket that this is basically a string, nothing
more than that.
So let's go ahead and again, call this user schema that, hey, user schema, you will be having an
access to a method and we are going to call this one as get forgot for God password.
Let's take their password.
Token okay.
Again, reminding you again, this is not itself a token so we don't use JWT or anything in that you
can, but there is no point of using it.
In fact, you are bringing a lot of unwanted heat onto yourself.
You shouldn't be doing that.
So let's work on how to generate the random string here.
So we're going to go ahead and say, Hey, this is going to be a basic function.
We don't need any input from the user itself.
We just can have this method on its own.
The first rule is to generate a long, long and random string so how we can generate a random string
in the JavaScript.
This is again a topic of a lot of debate that you can work on with.
And again, let me show you a couple of examples.
The first example is to be dependent on some packages.
So there is packages like Nano ID.
Some of you might be familiar with the UUID as well.
And as soon as you use this, this is going to give you something like this, which is definitely in
a unique itself and definitely usable, 100% usable.
No problem at all.
In case you want to bring this package, just go ahead and say, hey, I want to import this and I want
to say whatever this is and model nano ID.
So really a simple one of the most simplest tool to use in case you don't like this one.
There is no shortage of such packages like there is a random string package and you can just say npm,
install random string and as soon as you are going to say, hey, I want to require this and then simply
say generate it going to generate a random string for you.
You can also say that I want to generate random string of seven values or only alpha numeric.
So there's a whole lot of options, no shortage of such options, and in fact they are pretty much popular
as well.
A lot of people like to use that.
What I personally like to use that is something which comes up right out of the box from the node itself.
And if you'll if you'll just search it on the StackOverflow somewhere, how to generate the random string.
You'll find a lot of debate about it.
Which one is good?
3000 votes.
Come on.
This is something which a lot of people are interested in still.
So we can just have a characters and can generate on that simple for loop is going to work through my
favorite method again personal preference here.
My favorite method is not to use this random but actually to use a package which is crypto.
And I'll tell you the reason why we I actually love that personally.
So all you got to do is require the crypto.
You don't need to install it.
It comes up right out of the box from the node itself.
And then simply you can just generate a random byte just like this, and it will generate your random
byte of string just like that that finds that is great.
In fact, I'm going to go ahead and copy this line and work on with that.
So go ahead and copy this.
Come back onto here.
First, let's import the crypto.
So I'm going to go ahead and say, hey, I need a package known as crypto.
It is already installed in you so you can just say require and just say crypto again.
Default node package.
I'll come back here and I'll say, Hey, I need a token.
So I'll just say Var let's replace this with const and this is my forgot password token.
So I'm going to say forgot token.
Yeah, that's a decent name.
So Forgot Token is there.
Now this is absolutely 100% fine and you can just directly go ahead and save this.
In fact, you can you can just go ahead and say, hey, I want to just go ahead and say that this dot
forgot password token that is going to be updated by this forgot token, this is absolutely 100% fine.
There is no problem in this one.
But I like to go ahead and move on to one step further onto this one and would like to introduce you
a small concept here as well.
There is something, a concept known as cryptographic hash function.
Now, again, this is not too much required here.
You can skip this, but I love to do it.
Now, what this actually does, it actually is an algorithm that maps the data of arbitrary size that
can that means any size to a bit area of fixed size.
So whenever you actually go ahead and give it a string, it always generates a kind of a string which
is always fixed in size.
But the advanced thing is that the only way to to find the message, what's inside this string is actually
brute force, which can take a really long years, and the information is not going to be valuable.
So cryptographic functions are basic need of it.
So we would love to hash this generated string which is generated again.
This is already a very secure string, but I personally love to actually go ahead and kind of encrypt
this one.
So for this, it's really simple.
It's just a couple of lines that you have to write.
So crypto dot simply create hash, that's all you got to do.
But a little bit more methods are chained on on top of that.
So first you need to define what kind of hashing algorithm you want to use.
Again, notice they are mentioning it here algorithm as a string, then option and crypto hash option.
So you need to use all of them.
Again, there is no shortage of such algorithm.
One of the favorite ones for everyone is to 56 SHA, because encryption done by this algorithm takes
years to decrypt even with the brute force, then you can just pass on what is the value that you want
to update.
So my value is just this forgotten.
Token and I want to create a digest on that.
So I'm going to go ahead and say, hey, digest and digest is going to be of type of hex.
Again, it moved on to the next line.
So let me show you it on one line.
There we go.
So this is how it looks, this forgot password and all of that.
Now, I would like to add a comment here.
So now you see that on one line.
I can go back here.
Now, I would also like to add one line of comment here for you.
So this is actually we are getting a hash.
So this means that if you are using this method, then make sure to get a hash on on the back end as
well.
Now, this is a model this is this is definitely a back end, but this is so when the user is going
to give us because we are storing inside the database this hash, we are not storing this forgot token.
And what will be sending to the user is simply this forgot token.
We will not be sending this hash to value because we want to compare this.
So whatever user sends me there, I will again run the exact same function on this.
And if the token is going to be same, I'll get the exact same value here.
So again, really the simple this is kind of a my way of tokenizing the thing and then let's set a time
on this time of token.
So again, this needs to go into the database so I can go ahead and say, hey, this dot forgot password
expiry and this is going to start from date now.
So whenever somebody calls this method, let's go ahead and add probably 20 minutes is fine.
So let's go ahead and say 20 minutes and I have to multiply it by 1000.
So this is how we get it again.
Do you want to control this time from the E and V?
Just go ahead and add this one.
You can just add one more field which says, let's just say call it as forgot password expiry and you
can just cut this entire line and that's it.
And in place of here, you just have to write, processed and be not forgot password expiry time.
That's all you've got to do.
Now, again, the most important thing here is that make sure you go ahead and return.
What you are returning really, really is important.
We are going to return this forgot token.
Yes, I could have stored this entire value into a string, could have returned that.
But again, that doesn't make any sense.
You can return why we are doing any hash if we just want to return this hash.
So again, remember what I'm trying to say is we are creating a token on this random number, but in
the database the hash values are stored and we are sending this user this forgot token only.
So when he sends me back, then this comment line comes in that makes sure whatever user is sending
you back this token, you make sure you encrypt that and then compare it with the database.
If the both value matches, that means the value was not tampered, the value was not being manipulated
and you are getting exactly the same.
Do we need to go through with this much of the things?
Probably not.
But again, I wanted to show you a little bit on how more complex can go when you design a pro backend.
Again, totally optional in case you don't want to do this much of the thing.
No worries.
You can just store this forgot password into the database itself, send it on the front end, match
it at the time and that's it.
Totally a total.
Total.
Your choice.
Okay, so that's it.
I guess that's all what we wanted to do into this user model.
Had a great discussion on this one.
I hope you enjoyed that many details as well.
Let's go ahead and catch up in the next video.