Instructor: It's time to build authentication.
Now I know this is the stuff
that I know a lot of you have been waiting for
so I'm very excited to be talking about authentication.
We're gonna take this on a pretty metered, very easy,
very leveled approach.
So we're not gonna speed through stuff too quickly.
We're gonna make sure
that we understand what's going on step by step.
One thing I found really interesting about authentication
when I was putting this section together
is that there's not a lot
of great end to end tutorials out there already.
So there are many tutorials about authentication
but almost every single one of them
ends up skipping some very important step.
So my goal here is to make sure
that the app that we're going to build,
which is gonna be all about authentication,
is going to be rock steady with no shortcuts,
no easy way out anywhere.
So we're gonna make sure that everything works
in a very production ready fashion as much as possible.
So as we go through this process,
we're gonna first talk about what authentication is
and how we are going to authenticate users.
We're then going to start working
on these server side setups,
so we're going to build an entire server solely
for authentication with no react, no redux whatsoever.
One thing that I get asked a lot about
is what's the best backend for a React app?
And so here's my absolute answer to to this question.
What is the best backend for React application?
The answer is there is no best backend
for React application.
All React and Redux care about
are that they're being served JSON.
That's all they care about.
They just want JSON data.
So as long as you have a backend
that can serve some JSON data, it'll be good to go.
The reason I mention that at this point is the server
that we're gonna build here for authentication
is not just limited to use with React and Redux.
The server that we're going to put together
is a hundred percent appropriate
for any different type of application you want to use.
We are going to building an API
that can serve data to authenticated users.
That's the key.
That's what we're trying to build here.
So step one is to make sure that we're on the same page
when we're talking about authentication.
I wanna make sure
that we are talking about the exact same thing.
So I've got a diagram that's gonna walk us
through the authentication process.
So on the left hand side is a column
that indicates kind of stuff that's undertaken by our client
or our React application.
On the right hand side is stuff that's undertaken
by our node application or our backend, our API.
So this is the flow that we go through.
The client is gonna supply a username and a password.
The server is going to look at that username and password
and it's gonna say either the credentials are bad,
they don't match to what's saved, or they're good.
If the credentials are good,
we now consider our user to be authenticated.
Now the key here is that when a user is authenticated,
they should be able to make subsequent requests
without having to resubmit the username and password.
So when a user is authenticated,
we want to hand them a piece of information
that identifies them on all future requests.
That's the key.
This is the hard part right here.
This is the hard part.
Once a client has that identifying piece of information,
they can now make authenticated requests
and so at some point in time they can say, okay,
I need some access to some protected resource.
Here's my identifying piece of information.
The client will pass that to the server
and the server says, ah ha,
I see you have included the identifying piece
of information that authenticates this request.
This a identifying information
corresponds to user with email stevengrinder@gmail.com.
You are authenticated, so here is your protected resource
and then that process is just repeated over
and over again so long
as the client has that identifying piece of information.
So the key here
when we're really talking about authentication.
We're talking about exchanging a username
and a password for some identifying token
or for some identifying piece of information.
The client then includes that
on all future requests that need to be authenticated.
So again, the tough part
is this identifying piece of information
and this is what we're gonna spend a lot of time
and a lot of effort to figure out.
So now that we are on the same page
about where we're headed, where we're going,
let's get started in the next section.
I'll see you there.