All language subtitles for 006 Signing up Users_Downloadly.ir_en

So previously, we already implemented

a simple signup functionality,

but in this lecture,

we will actually also log the user in

making a more real signup process.

So starting from this lecture,

we will really start to implement our authentication,

and so this where it gets really serious.

And so therefore, before we start

I want to give you a warning here,

so authentication is very hard to get right

and many tutorials out there that you're gonna find

when you search for authentication

with like Node.js and Express,

many of these make many serious mistakes

and oversimplify things that should not be simplified.

All right, this is not to say that all tutorials out there

are bad, all right,

or that are useless or something,

but I really spend weeks researching all the best practices

and refining and improving my code,

to make this authentication section

that we're gonna start implementing now as good as possible,

for a beginner like you, all right,

and that is because we need to be really really

extra careful when writing this part of the application,

because remember, our user's data is at stake here,

and the trust in the company who runs the application,

is at stake as well,

and so implementing authentication,

is a real responsibility

where you should not make any mistakes at all.

Now there are some libraries out there

that can help us implement authentication

and authorization and the most well known one

is called Passport,

but even a library like that

doesn't take all the work and all the responsibility

away from you, all right.

Now in this case here,

we are actually gonna implement the whole login

protecting and authorization logic all by ourselves,

except of course for the Jason web token implementation

that we talked about in the last video itself.

Okay, so all the signing and verification

all that stuff, we're gonna leave to the WJT library

but then the rest, we're gonna implement ourselves

over the next couple of lectures.

Now as I mentioned earlier,

we already have our signup function here, right,

but right now, all it does

is to simply create a new user

and then send it back to the client.

Now shortly after finishing recording this course,

I actually noticed that

there is a very serious security flaw

in this way of signing up users,

so basically the problem is that right now,

we create a new user using all the data that is coming in

with the body right,

and so the problem here is that like this,

anyone can specify the role as an admin right,

so basically, everyone can now simply register as an admin

into our application,

and so that's of course not we need.

So again this is a serious security flaw

and we of course we'll need to fix that

and to fix is actually quite simple.

So what you need instead of this line of code,

that is selected here

is this piece of code that I just put here on the screen.

Okay.

So again, please go ahead and delete this line of code

that is currently selected here

and replace it with the code that I just put here

on the screen.

Now what's actually the big difference here,

well, with this new code,

basically we only allow the data that we actually need

to be put into the new user

so just a name, the E-mail and then the passwords.

And so now, even if a user tries to manually input a role,

we will not store that into the new user,

and the same for other stuff,

like for example, a photo.

So this is the quick and easy fix for that problem.

Now what this will do,

is that we can actually no longer register as an admin,

and so if we need to add a new administrator

to our system,

we can then very simply just create a new user normally

and then go into MongoDB Compass,

and basically edit that role in there.

So edit it from user

to admin manually, okay.

Of course we could also define a special route

for just creating admins

but that would be a bit too much.

Okay, so let's now move on.

Just notice that the code in the rest of the video

and all the videos in this course

will of course still be this old wrong version, all right,

but actually in the final code

that is in the GitHub repository,

I already fixed that and we have the correct code in there.

Anyway, usually when we sign up for any web application,

then you also get automatically logged in, right,

and so let's very quickly implement that here.

So log the new user in,

as soon as he signed up, okay,

and remember from the previous lecture,

how that works,

well all we really need to do,

is to sign a Jason web token

and then send it back to the user, okay,

but let's now first of all install the MPM package

that we're gonna use for everything related

to Jason web tokens.

So in our other terminal,

let's say MPM install, Jason web token,

so all of this together like this

and that should then install this package

and let's actually go ahead

and take a look at it at GitHub,

just to see the documentation

and let's do that here,

we no longer need this one here for now at least,

and so this will take us to the page on MPM,

and so you see

how popular this package actually is,

so we have 2.3 million weekly downloads,

so that really is a ton of downloads

and we can take a look at the documentation here as well,

but I personally prefer to do it on GitHub.

I think it looks a lot cleaner here,

and I'm so used to it at this point,

and so I usually just see it here, okay.

Anyway, the first functio that we're gonna use

with JWT here is sign, okay,

so in order to basically create a new token,

and for that of course we need the payload,

we need the key so that private secret

that I mentioned before

that's only stored on our server

and that we need to sign the token

and then we can pass on some options

and we will do all that in a second,

I just want to show the other function that we have here,

and that we really have a ton of options here,

for example the expires in,

which we're gonna use to use also,

so all of this stuff

and then we have verify.

So we also talked about the verification process

and that's basically implemented in this function, okay,

and so this is the one that we're gonna use,

when logging in a user, okay,

and that's really all there is,

so you have all this different options here, okay,

you have also decode

but that one is not really important, okay,

so you see that this package really only includes

the two functionalities

that we discussed in the previous video.

So signing and then verifying, okay.

So let's go back here

and actually start using the Jason web token package.

So let's import it here,

and it's usually simply called JWT

and require the Jason web token.

Okay, so lets create our token here,

okay,

and I'll like to simply call it like this so just token,

okay, then JWT dot sign,

and now the first thing is the payload,

and this is basically an object for all the data

that we're going to store inside of the token,

and in this case,

we really only want the ID of the user, all right,

so nothing crazy here, not a lot of data

that's not really important.

So we say that the ID is

and then we simply get the ID from the new user

that was just created, okay,

so new user dot and then remember that in MonogoDB,

the ID is actually called underscore ID, all right,

and so that is the object that's the data,

the payload, that we want to put in our JWT.

Next up, we need the secret, okay,

so basically a string

for a secret, all right,

of course this is a terrible one, all right,

this is just kind of a place holder

because actually, our configuration file

is a perfect place to store this kind of secret data,

so just like password for example,

and so let's go add and edit here, okay,

so let's call it JWT, secret,

and of course the name that we give here,

doesn't really matter

but what does matter is the secret that we specify here,

all right, because using the standard HSA 256 encryption

for the signature, the secret should at least be

thirty two characters long, all right,

but the longer the better actually

and this is where many tutorials out there fail,

some of them simply put a very short string here,

but that's not ideal again,

so for best encryption of the signature,

again you should at least use thirty two characters,

so I'm gonna create my secret here now

but you should really really use another one, okay,

please don't use the same one as I am doing

because that could become a security issue

for your application, okay,

always use a unique secret for your applications

and never the same, all right,

and especially not the one from someone else

so definitely not the one that I'm typing now.

So this can be anything,

it doesn't have to be weird characters or stuff,

I prefer to use a phrase like this,

my ultra secure and

ultra long secret,

so what happened here,

anyway this should be thirty two characters long

and so this is the one

that we're gonna use for my Jason web tokens,

but again please use another one, all right.

Anyway, let's go back to the authentication controller here,

and now actually use it.

So remember a environment variable

is process dot end dot JWT secret,

okay.

So at this point, we have the payload

and we have the secret.

The token header will actually created automatically

but now what we can also do

is to pass on some options,

and the option that I'm gonna pass in

is when the JWT should expire.

So this means that after the time

that we're gonna pass in here,

the Jason web token is no longer

gonna be valid,

even if it otherwise would be correctly verified,

all right,

so this is basically for logging out a user

after a certain period of time

simply as a security measure, okay.

So let's actually define that expiration time also

as a configuration variable here,

so JWT expires in

and so here of course , you can use the same time

as I am putting.

So we can use a special string

like for example 90D

and the signing algorithm will then automatically figure out

that this means ninety days, okay,

you could also use like ten hours or five minutes

or three seconds or something like this,

or just any number,

which will then be treated as milliseconds

but I think it's best to simply use ninety

or something D, so in this case, ninety days, all right,

and so again, after ninety days,

the JWT will no longer be valid,

even if the signature is correct and everything is valid.

Okay, so again just like an additional security measure,

okay,

so these options as always, we passed them in as an object

and then let's specify the expires in,

so expires in and then process dot end

and then JWT expires in, okay,

and this here will then add some additional data

to the payload,

but that's of course no problem at all.

So we just created a token,

now all we need to do,

is to send it to the client.

So let's put it here before the user actually

and then that's actually it.

That's really all we need to do to log in a new user,

because right now we're not checking

if any password is correct

or if the user actually exists in the database

because here in this case,

the user was really just created,

and so right away,

we logged user into the application

by sending a token, okay,

and the use of client should then in some ways

store that token, just as we talked about before

in the previous lecture, okay,

so let's give it a save here,

and let's actually try it out, okay,

so let's us my old address here,

hello@jonas.io, let's send it,

and let's wait for it

and indeed, here is our Jason web token

so congratulations, you just created

your very first Jason web token

which should look a little bit like this,

and of course it's not gonna look exactly the same,

because our secret is also not the same, right,

and now what I want to show you,

is the JWT debugger,

that I showed you as a screenshot earlier

in the last video.

So let's go ahead and copy this token

and then let's go to JWT.io,

okay,

then down here we have the debugger

and so let's delete this one here,

and put ours and right away

you see that our signature is invalid,

but that's because the sign function edits

these two properties here,

because we specified an expiration date basically.

So this here is issued at,

and this is expiration time, okay,

so if we remove these two from here,

you will see that now,

this signature is actually verified,

okay so what's important to notice here,

is that of course the header is visible

okay it's easily decodable basically,

and so you that we did not specify any of this,

it was the Jason web token package that did it for us,

but that here is actually the payload that we specified,

so if we take a look at this ID,

it should be exactly the same as we have in postman,

so ending on six OF,

and so indeed, it is exactly the same right,

okay, so these two here are open

and then the signature of course, we cannot really see,

because of course our secret is just that,

it's really secret, all right,

so this was just to show you that everything works,

and let's close this up,

and yeah, we're not able to log users in,

but only if the user just signed up,

because in that case, we do not need to verify

the email in the database,

and also not the password, okay.

So doing all that is a way more complex process,

and so that's actually what we're gonna do

in the next lecture,

so next up, we will actually log in users,

based on their email address and their password.