Okay, so we have a way to validate the user's email and password.
And now we want to start getting into Json web tokens.
So I just want to briefly talk about how they work.
So in web development, there's many different ways to authenticate users.
You can use cookies, sessions, Json, web tokens or a combination, and there's other services like
OAuth and there's third party services like Auth0 In this course we're going to we're going to go with
using Json web tokens because I want to keep this as barebones as possible.
I don't want to go and use any third party services or anything like that.
I want you guys to to know how to do this pretty much from scratch.
So a Json web token is a secure way to share information between two parties, such as a web server
and a client.
And it consists of three parts a header, a payload and a signature.
And the payload contains information like the user's ID or the user's role.
And the signature is used to verify the information hasn't been tampered with in any way.
So JWT s are commonly used for authentication, which is the process of verifying a user's identity.
Now, traditionally, Json web tokens often get stored in the browser on the client.
So basically we would log in, we would have we would validate just like we did in the last video,
we would send a token and then we'd store that token in our local storage on the client and then send
that token to any protected routes where we had to be logged in, where we had to authenticate.
Now that's not the best way to do things.
It can be insecure because you are storing it on the client, so you open yourself up to cross-site
scripting attacks and all kinds of stuff.
So we're not going to do it that way.
What we're going to do is we're going to generate a Json web token.
However, we're going to store it in an Http only cookie on the server.
So we're going to write some middleware that will basically, once we authenticate or we register,
it'll create the token, store it in an Http only cookie, and then that will get sent with every request
from then on.
Okay.
So it's not actually going to be stored in our browser in local storage, which makes it much safer.
In the first version of this course, we did store it in local storage and I think that's fine for some
cases.
If you're going to have a large production app, you're going to have a lot of users and stuff, then
you probably shouldn't do it that way.
So this is a better option in my opinion.
All right.
But like I said, there's so many different ways to authenticate these days.
Now this is jwt.io, and you can actually paste any Json web token in this box here.
So this is what it will look like.
And like I said, there's three parts.
There's the header which you can see in red.
So it just has the algorithm and the type and then the payload, which you can pretty much put whatever
you want in here.
In our case, we're going to want to put the user ID because when we when we are logged in with a specific
user and we want to do something that requires us to be authenticated, we want to we want the system
to get our ID from the payload, from the Json web token, and then we just have the signature to make
sure that everything is valid, make sure nothing has been tampered with.
All right.
So that's what it looks like.
And I'll keep this open so that when we do actually generate a token, we can paste it in here and see
exactly what we get.
All right.
So in the next video, what we're going to do is make it so we generate a token.
So this is a package we're going to install called Json Web token, and we're going to use that to both
generate and verify the token.
All right.
So we'll get to that next.