Instructor: In the last section,
we created a JWT strategy,
and then we wired it up to Passport.
Remember, strategies are part of the Passport ecosystem,
and we use them to authenticate our users
in different fashions.
In this very particular case,
because we were using JWT tokens, we used a JWT strategy
provided to us by the passport-jwt library.
So, at this point in time, our strategy is all wired up,
and we've successfully told Passport
that it needs to use this strategy.
So let's look back at our diagram.
So we said that whenever there's an Incoming Request
for some protected route
or some route that requires authentication,
it should first pass through Passport,
and if it successfully gets authenticated,
then it can go onto the actual Route Handler.
So we need to actually wire this thing up.
We need to actually say somewhere in our code,
Hey, for this very particular Route Handler,
make sure this passes through Passport ahead of time.
So that's what we're going to do right now.
We're going to wire up a very particular route
to use Passport.
So I'm gonna go back up into our router file.
Here we go.
And inside of the router file, I'm going to first
import (typing)
our passportConfig. (typing)
Actually, let's call it
passportService. (typing)
That matches the name of our file here, a little bit more.
So we'll look into services passport.
Next, we'll require passport itself, the library.
(typing)
And now we're gonna create an object
that we're going to kind of insert in the middle there.
It's gonna be the part that occurs in the middle,
between our Incoming Request and our Route Handler.
So, this next part is gonna be a line of code
that's gonna create this kind of middleware of sorts,
or this interceptor of sorts.
So we're gonna create an object,
const requireAuth,
passport.authenticate,
using the jwt strategy.
And when a user is authenticated,
don't try to create a session for them.
So by default,
Passport wants to try to make a cookie-based session
for this request.
Since we're using tokens, we don't want that,
so we're gonna say session, false.
So now, this requireAuth object right here
is that middleware,
it's that interceptor of sorts,
it's that part in between.
So, for any very particular route
that we want to require authentication for,
we'll use this requireAuth helper.
Let's see what it looks like in practice.
I'm gonna make a new route,
and it's just gonna be a dummy route of sorts.
So I'll say the root route,
if anyone gets this first, send them through requireAuth.
And then, if they get through that,
then you can can run this function to handle the request.
And for my Route Handler,
I'll just say very simply res.send,
hi there, like so. (typing)
So we defined a new Route Handler to handle a GET request
to our root route.
We said that any request coming in
must pass this requireAuth step,
and then it could go onto the Request Handler.
So let's save this and give it a shot inside a Postman.
I'm gonna flip Postman back up.
I've got a GET request selected,
and I'm trying to visit the root route.
Let's click "send,"
and I get the error message "unauthorized",
which means I do not have a token
associated with my request right now.
If I wanna get access to this route,
I need to supply a valid token.
So let's do this by hand.
We're going to manually wire up a token.
The first thing we need to do is get a token
by signing up for an account.
So I'm going to make a post request
to /signup.
I'm gonna go to the "Body" tab, and I'm gonna make sure
that I've got an email and a password on here.
I'll send the request, which returns a token.
I'm going to highlight the entire token.
So everything inside of the quotes, I'm gonna copy it.
All right, we're gonna copy it,
and then we'll try making a GET request again.
So I'm gonna go back to a GET request to our root route.
And now the last part that, this is the crazy part,
this is the hard part.
This is what ties it all together.
Where do we put the token?
Right?
We put the token,
we said that whenever we tried to authenticate our user,
we're going to try to get the token
from a header called authorization.
So if we add a header, we can add one very easily
by selecting the Headers tab over here.
And then I'm going to add a header called "authorization",
lowercase a,
and I'm going to paste the token as my value.
So now, I'm gonna make a GET request to my root route,
with an authorization header containing my jwt token.
Let's send it.
And I successfully get "Hi there."
Perfect. Just what we wanted.
Let's see if we can break it.
So I'm gonna,
up here, my token,
I'm just gonna go to the very start of the string,
and I'm gonna add like a 1.
So now, it's not the same token,
I just added another character.
It's not the same token anymore.
I'll send it now,
and I get "unauthorized", just what we want.
If I take it out, I can send it again,
and I get "Hi there" again.
So boom, there we go.
This is our authorization in action.
Fantastic.
I like it a lot.
Looks very good.
The last thing we have to do inside our application now
is implement the sign in route.
So we've only done sign up.
We haven't done anything for signing in.
So let's tackle that in the next section.