Welcome back in this you know we're focusing on user authentication where you start off for short.
In my experience authors something that students are really excited to learn about because they feel
that it makes her apps legitimate and makes them feel real and usable.
If you can sign up you can log in and you can log out.
So that makes it a fun and exciting thing to teach.
But the truth is it's also a really hard thing to teach because authentication is pretty complicated
.
There's a lot of moving pieces that have to fit together in just the right way to make it work.
A lot of big concepts.
And honestly it's a lot of code to make it work.
Fortunately for us there are a lot of great tools out there that help us implement authentication quickly
and safely.
Now explain what I mean by safely later in this video.
Before I dive into explaining the tools and the workflow of authentication I want to spend some time
giving you some insight into my thought process behind teaching art.
It's one of those topics that I've spent a lot of time teaching it but also teaching it in multiple
different ways.
When you're teaching user authentication there's a choice that you have to make.
And for me that choice was going to teach authentication from scratch not using any tools at all and
making sure that students focus on the ins and outs of every important concept and it might take five
six hours.
It might be a lot of lessons a lot of videos.
We might end up losing some students but we'll make sure that everyone understands how authentication
works.
Or do we use some of the existing tools out there tools that help us add user authentication faster
simpler and with way fewer lines of code and it all boils down to this issue of is it more important
for students to have a deep understanding of how things work.
Is that the priority or is it a priority to have students make things fast.
So is it about conceptual understanding and depth of knowledge or is it about making stuff.
Obviously in an ideal world we'd want both.
We want everyone to understand the ins and outs of everything that we teach and we want students to
have tons of practical knowledge and be able to make things quickly.
In the past I've tried both approaches to teaching where I started out by trying to give students a
deep understanding of every concept and how it all worked and fit together before we even implemented
anything.
And then I've also done the opposite where we just try and make some thing work first and then come
back and talk about how it works.
And I've spent even more time thinking about how we want to approach it in this video course I've recorded
this lecture way too many times I've reworked rewritten all the code.
It's one that I want to get right because it's really important and one that a lot of students look
forward to.
So what I've decided to do is to have two units in this first unit on authentication that you're currently
watching.
I'm going to start by giving you a very very quick overview.
Not at all in depth but just a quick overview of how authentication works.
And then we're going to use these tools that I talked about that make our lives easier and make the
code shorter.
We're going to use them right away.
And the focus is on just making something that has both an occasion and then one of the optional units
.
At the very end of this course is going to be a truly deep dive into authentication where we'll actually
implement our own user authentication from scratch where we won't use any of the tools and I'm going
to show you now the goal is to have the best of both worlds going to start by just making something
.
And I'm not going to breeze over all of the concepts but I'm not going to spend you know an hour plus
talking about how things work.
All right so now that we've gotten that out of the way this big ideological discussion here I want to
now introduce the tools that we're going to use so we're going to be using something called passport
.
Yes.
And we're not only using it because it's something that will make our life easier make our code shorter
make this implementation faster.
But it's also something that's used a lot in the real world.
Lots and lots of applications use passport J.S. to implement their authentication.
So let me show you the home page here.
This is Passport Chaiya stuttered and see the little tagline says simple unobtrusive authentication
for no J US passport is authentication middleware for node extremely flexible and modular passport can
be unobtrusively dropped into any express based web application.
A comprehensive set of strategies support authentication using a username and password Facebook Twitter
and more.
And then you can see down here there's actually more than 300 different strategies.
So strategy is referred to different types of authentication different ways of authenticating people
whether it's through having the user type an email and a password traditional authentication or if it's
through a service like Facebook or Twitter which you've probably seen before on a site or an application
where it asks you to log in through Google or Twitter or Facebook.
And there are tons more that we can actually view all of them and we can search through them so there's
things like Fitbit you can log in through Fitbit.
We have Spotify Reddit tumblr Google plus.
But by far the most popular are going to be Facebook Twitter and Google.
And then also what's known as local authentication which is what we'll start with here which is just
username or email and password.
OK.
So that's the base tool that we're going to use passport.
Yes it will be a huge help in our implementation of user.
But we're also going to use another package called Passport local which I have here.
And this is one of those schemes or strategies for authentication.
So there's a passport Facebook a passport Twitter passport Google and passport local and 300 plus different
strategies passport local is for username and password which is what we'll be doing to start.
But what's really great about passport is that later in this course we can go and add Facebook or Twitter
and we can keep local as well and we can have three 5 10 different ways of logging into our app.
Usually you want to keep it pretty limited but we can have as many as we want by using Passport and
to name passport.
It's about providing this entry point into all sorts of destinations.
OK and there's one more package we're going to use which is called Passport local mongoose.
So I have the get hub open for that and passport local Mongoose is another package that will just help
us implement authentication with passport and it is specially made to work with mongoose.
So we don't have to use it.
We could get away with just using Passport local the passport local Mongoose is going to help us make
it even faster and make it simpler for us.
And then of course in the optional off from scratch section we'll be creating art from scratch without
any of these tools.
OK.
So those are the three main tools.
Now I'm going to give you a quick demo of what we're going to make upfront which I'll warn you it's
not very exciting visually.
I didn't style it at all.
But we will be adding you Seraph to yo camp and we will be styling that.
But for now this is a barebones implementation that I want to show you.
So we started out on this home page and we have three buttons.
Log in register and log out and there's a secret page slash secret that you can only view if you're
logged in.
So if I try and go there right now I'm not logged in and it takes me back to slash a log in and it shows
me the log in form so I'll register and I'll show you that we can then go to the secret page.
So user name I'll do rusty four or five six and password will just be password and then I'll sign up
.
And it takes me to slash secret which I can now visit.
And on the secret page I have a horribly embarrassing photo from my cell from my seventh or eighth grade
when I got my first laptop.
Just terrible.
So that's slash secret secret for a reason obviously.
And now if I go to log out I can no longer go to slash secret it redirects me to slash logon and I can
also log in here.
So I'll use Rusti four five six with the correct password which is just password and I sign up or log
in and it takes me back to such secret and I can go to the home page and back to slash secret because
I'm staying logged in.
So the way that this works the key concept that everything hinges around is something called sessions
.
I'll give a quick summary of what sessions are.
Basically it's GTP is supposed to be a stateless protocol which means that when you send requests those
requests are one time things and they don't contain information about your history or the previous requests
that you've made.
They're not linked together.
A request doesn't have a state it's just a one time transaction which would make it really hard to implement
user off because I want to be able to stay logged in.
I want the server to know that Rustie 4 or 5 6 is still logged in and the way that we do that is by
using sessions and what sessions will do.
They're just a way to make HTP not stateless.
There are a way to provide state so when every request that I make on this app when I'm logged in when
someone's logged in there's a little bit of information about that user that is saved in that request
that is sent to the server and it's not actually the user password of the whole user name.
But it's a little bit of information and it's encoded and it's basically made to be a secret.
And then it gets to my server and then passport will see that and it will translated into something
that it understands basically crack the code or unencrypted and it will use that information to tell
if someone is logged in or not.
So this will make more sense once we add the implementation.
But the key concept is that Sessions allow us to have state in our HTP requests.
So I can send data.
I can go back to the home page it it still knows that I'm logged in as Rustie 4 5 6 and I can go back
to secret without any problems.
And that's because every time I make a request I'm sending a little tiny piece of information that says
this is Rustie four five six who's logged in.
And then as soon as i log out that piece of information is gone.
So now when I go to slash secret I have some logic that says if there's no user in the session then
don't let that person go to such secret.
Redirect them to slash logon.
OK.
So we'll be going over all of that in more detail in the next video when we actually create this simple
application and implement sessions to get help with our sessions.
We're going to use a package called Express session that will see in the next video as well.
OK so that's all I want to introduce for now.
So we're going to be using Passport J as the local scheme along with the passport local mongoose module
or package that will help us implement user authentication pretty quickly and relatively painlessly
and we're going to get it going in the next video in a simple app.
And then once we have this working we're then going to go back to camp and implement user auth there
.
All right I'll see in the next video