Instructor: I want to take a minute to review everything
that we did with this server before I move on.
So the key critical part was this diagram right here,
this kind of flow that we assigned.
We had three possible flows coming into our server.
Either you were signing up, signing in,
or trying to get access to some protected resource.
In the case that a user was first signing up
we verified that the email was not already in use
and then we gave them a token.
The token was some identifying piece of information.
It was a JWT or JSON web token.
We created this token using the user's user ID
and we also encoded the issued at time in there as well,
just so we know when the token was first created.
Then whenever a user came back to use our application again,
let's say that they were supplying their email
and password again, so again,
an end user has no idea that a token exists.
They only know that they have a username and password.
So when a user supplied their email and password to log in,
we verified that their email and password were correct
using the local strategy plugin for the passport.
After we verified that they had the correct email
and password, we assigned a token to them.
Finally, whenever a user came back to our application
to make an authenticated request with a token,
we verified that the token existed
and that it was the correct token,
and then we gave them access to the resource access,
to whatever their, you know, protected resource was.
This verified token step was done using the JWT strategy
which is, again, a plugin for the passport library.
I hope you've enjoyed this section.
I know it's probably been very challenging.
Definitely not the easiest content in the world
but we have built from scratch a very solid,
very secure API server that we can use,
not only for web applications,
but also for mobile applications as well.
If we want to add any protected route in the future
for absolutely anything,
all we have to do is define our route handler
and then pass in this require auth as the second argument.
And then the third argument is always gonna be
whatever the protected route is.
So very versatile, very flexible,
and we can really take this in any direction we want.
If I were in your shoes
I would probably commit everything that I have right now
to GitHub and I would treat this
like a boiler plate project that I could spin up on the fly
for any project I wanna work on and know that
I've got a rock solid authentication server ready to go.
So I hope you've enjoyed this
and it's definitely been my pleasure to show it to you.