Instructor: We're now returning a JWT token
whenever a user signs up for our application.
We're in a pretty good spot right now.
So let's take a second to talk about
where we are and where we're going
for the rest of this entire video
or this entire section on authentication.
At this point,
we have the ability to sign a user up for our application.
We are encrypting their password when it's stored
and we're generating a token for them to use.
There's two major tasks that we still have ahead of us.
Number one, we need to be,
we need to give our users the ability
to sign into our application.
That is, once they've signed up,
we need to now give them the ability
to exchange a username and a password
for a token in the future.
Right now, they can only get a token by signing up.
So that's task number one.
We have to handle the login case.
Task number two is we need to implement some ability
to verify that a user is authenticated
whenever they attempt to visit some protected resource.
Let's take a look at a diagram
to kind of illustrate what I mean by that.
So let's say that we have
the Authentication Controller right now
and let's imagine
that we also have a controller called Comments Controller
and maybe Post Controller as well.
And if a user is going to get access to either the,
either these controllers,
they need to be authenticated ahead of time.
So we need to build
is something like this box right here.
This thing to ask the question,
is this user logged in?
Are they currently authenticated?
Did they include a JWT token with their request?
And if they did,
is it a valid token?
So that's what we're gonna spend time
in this section to build.
We're gonna build the,
we're gonna build a service to answer
whether or not the user is currently logged in.
Once we know whether or not they're logged in,
we'll go back and work on the sign in route.
Because once we do this kind of logged in,
you're gonna be surprised
at how easy it is to do the sign in as well.
So to assist us with this kind of login case right there,
or this login handling,
it's something that we want to intercept
on only some routes, right?
Everything is gonna come through our router
and only on some very particular routes,
do we want to check to see
whether or not the user is logged in
which is indicated by the presence of a valid token.
So to build this thing,
we're going to use a library called Passport
or colloquially called Passport js.
Passport is an authentication library for Node and Express.
It's usually used for cookie based authentication.
And so it has a lot of helpers
for cookie based authentication.
We're going to use it with JWT tokens however,
and so we're gonna go down a slightly different route
with it than some other use.
If you've ever used in the past,
we're gonna have a slightly different implementation of it.
So let's get started by installing the JW
or the Passport library.
Over in my terminal,
I'm gonna end my server process
and I'm going to install two libraries.
I'm going to install passport
and we're also going to install passport-jwt.
So let these install for a bit.
While that goes,
I'm gonna flip back over to our code
and I'm going to make a new folder
to host all of our passport configuration.
I'm gonna make a new folder called services
and inside of it,
I'm gonna make a new file called passport.js.
So this is where we're going to put together
a bunch of configuration,
a bunch of logic to help set up Passport.
And again, Passport is what's going to help us
authenticate a user when they attempt to visit a,
a route that requires authentication.
So it looks like my install is all done.
I'm gonna start my server back up with npm run start.
Excuse me, npm run dev.
Going into autopilot.
There we go.
Okay, so I'm in passport js.
We're going to include,
we're going to import a couple files at the top here.
I'm going to include passport.
I'm going to include our user model.
And to get access to that,
I need to go up one directory into models
and then get at user.
So I'll go up models/user.
I'm gonna get our config file,
which has our client secret
and then I'm also going to include the Passport JWT Library.
And we'll talk about exactly
what that's doing for us in a second.
And I'm going to very specifically call this JwtStrategy.
I'm gonna require it from passport.
And I'm gonna pull off a very particular property
off of this required statement.
So I'm gonna get at Strategy,
the Strat, Strategy.
There we go.
And we'll also get one more,
ExtractJwt, passport-Jwt, extractJwt.
Make sure that your JwTs
across the board are capital J and then lowercase wt.
So we imported three modules at the top
and then we also imported twice the passport JWT library
and we pulled off the strategy
and extract JWT properties off of here as well.
So before we go any deeper
or any more code in here,
I wanna talk about what we're going to be building
or what we're going,
exactly what Passport is gonna be doing for us
and why we need this passport JWT set up right here as well.
To explain what's going on there.
Let's, it's gonna take a little bit of time
so let's tackle that in the next section.