Instructor: In the last section we discussed JWTs
and how we were gonna create them.
We were gonna take a user ID,
combine it with our secret string,
and poof, here's our web token.
Now, as you might imagine, we're not going
to implement all the logic
for creating a token from scratch.
Instead, we're gonna use an existing library.
So the library that we're going to use
to create a JSON web token is called jwt-simple.
So we'll need to install it as an NPM package.
Over my terminal, I'm gonna stop my server,
and then I'll run npm install --save jwt-simple.
So this is a small library,
it should only take a second to install,
and boom, there we go.
I'm gonna start my server back up with npm run dev
and then flip back over to my code editor.
So remember, to create a token,
we have to provide a secret string of sorts
and we wanna make sure
that we never share this secret string with anyone else.
So to house our secret string,
I'm gonna create a new file in my project,
I'm gonna call it config.js.
I'm gonna make it in my root project directory.
So the purpose of this file is
to hold application secrets and config.
I'm gonna create an object,
and this object is going to hold my secret string.
And as far as the string goes,
it can be any sequence of characters you want.
I'm gonna put in just some random sequence like so.
Now to make sure that I never commit this file to GitHub
and post it publicly,
I'm gonna go over to my .gitignore file,
and I'm gonna add config.js to it.
That means that I'll never end up
committing this file right here.
Okay, so we've got our secret in place.
It's a random string of characters, very good.
I'm gonna go back over to the authentication controller.
And at the top we will import
both the JWT library that we just installed
and the config object that we just created.
So I will say const jwt = (require'jwt-simple')
and then I will also import
the config object that we just created.
So I'll go up one directory and I'll get config.
Now we need to make a function that is going
to take a user's ID and encode it with our secret.
So I'm gonna create a new function
and I'm gonna call it tokenForUser.
The only argument to this is going to be a user model
and I'll return from it,
I'm gonna use the JWT library to encode
some amount of information
that we'll add in here in just a second,
and it's going to be encoded using our secret string.
So the first argument here is the information
that we want to encode.
The second argument is the secret
that we're going to use to encrypt it.
So the question is now, well,
what information do we wanna put in here?
We could put in any information that we want.
In the diagram they were looking at earlier,
I said, "Hey, let's use the user ID."
And that's actually a pretty reasonable idea.
You might be thinking,
"Well, "let's encode the user's email address
"and then we can just look at the user by email."
And that doesn't always quite work out.
And the reason for that is
that the user's email can change over time.
If they ever wanna change their email
and then they have some existing tokens sitting around
that make reference to some old email address,
that might lead to some weird stuff.
Once we create a user, they should always have the same ID.
So we will just encode the user's ID.
The second thing we gotta think about is
that this is an object.
We need to assign the key, or excuse me, the ID to some key.
I'm going to put a very particular key in here
and then we'll talk about why I'm using it.
I'm gonna put in sub: user.id.
So what is sub exactly, right?
What is sub doing for us?
So JWT, JSON Web Token,
is not something that I just made up,
it's not something that any one guy made up.
It is a standard, it is a convention.
As a convention, JSON Web Tokens have a sub property
which is short for subject.
Subject meaning who is this token about?
Who does this token belong to?
So we're going to say that the subject
of this token is this very specific user.
I'm also gonna add in one other piece
of information on here.
I'm going to add in a timestamp
of when this token was issued.
So I'm gonna say new Date().getTime();
and I'm gonna add on another property to my token,
and it's gonna be iat.
iat is another convention of JSON Web Tokens
and it stands for issued at time.
And so I'm gonna say that it was issued
at this instant right now.
All right, let's save this.
I wanna do two things here.
I wanna first add the token
to our response to the signup route.
And then I wanna go just quickly refer you
to some documentation on JWT
so you can do some reading if you want to look
at all these different properties that are available.
So I've got this token for user method
and down inside of our success handler for user.save,
we're going to replace success: true with
token is tokenForUser(user).
So let's give this a shot in Postman now.
I'll flip over to Postman.
I'm still on my signup route.
I'm gonna put in a unique email, I'll send it,
and I now get back a complete token.
Cool, so this is looking pretty darn good.
I'm gonna flip back over to the code
and I'm gonna open up Chrome really quick.
And inside of Chrome
I just wanna give you some resources on JWT
if you wanna do more reading.
So we can just search for JWT token
and the first result on here is gonna be jwt.io.
So if you go here, there's a fantastic discussion
about exactly what web token is
and all the different libraries that are available
and a lot of different properties
that you can issue on JWTs as well.
So feel free to give a read through this.
Otherwise just know that we are using the sub
and issued at time properties of JWT.
Okay, So this is looking pretty good.
I'm happy we got our token.
This is fantastic.
We can now make authenticated requests in the future
once we figure out how to decode the token in the future.
So let's continue in the next section.