Okay, so now we're going to start to implement Json web tokens.
I just have my user controller open.
I did stop the server because I'm going to go ahead and install Json web token and we will make sure
you install this on the back end, which means in your root, don't go into the front end folder.
So let's say NPM install and it's going to be Json web token with no dashes.
Okay, so we have that installed.
Now I'm going to run NPM run dev again, which runs both my back end and front end.
And we're going to generate the token, first of all, just right in the controller.
But later on, we're actually going to put it into a utility file and then just bring it in.
But for now, we'll do it from here.
So let's import and we're going to say JWT from.
Jason, Web token.
This shouldn't be like this.
It should just be all lowercase and it's a default export.
All right, now let's go down into our auth user.
So we're checking to see if the password matches and all that.
And right before the Jason, where we send the Jason, we're going to create the token.
So let's say const and token and we're going to set that.
Equal to JWT, which has a method called sign, which will basically create the token.
Now this takes in a few things.
So first is going to be an object with the payload.
And remember what I want to send in.
The payload is the user ID, So we're going to set that to user, which we're getting right here, Right.
And then the ID, so dot underscore ID, and then the next thing we want to pass in is the secret.
Now, you don't want the secret to be just put in this file, you want to put it in your environment
variables.
So what we'll do is we'll say process dot env dot and then let's do JWT underscore secret.
Okay.
We haven't created that yet, but we'll do that in a second.
And then the last thing we're going to do is put this in.
Is put.
When do we want this token to expire?
So we'll say expires in now.
I mean, this is really up to you.
You can put one day if you want like one D but since this is a course and I'm going to be coming back,
you know, coming to the code, leaving, coming back and so on, I don't want it to expire quickly.
So I'm actually going to do 30 days.
So 30 D should allow us to to do that.
All right.
Now, this will create the token.
However, that's all it's going to do.
It's just going to put it in token.
Now we need to decide what we want to do with it.
Now, in some cases, such as with the first version of this course, I would send it back in the Json
and then we'd store it in the front end in local storage.
But again, I don't want to do it like that.
What I'm going to do is set it into a cookie on the server.
So let's say set JWT as an Http only cookie.
And the way we do that is we can say rez dot cookie.
And then we're going to give it a name.
I'm going to call it JWT, and we want to pass in the token.
That's the value.
Okay?
The token we just created and then we can have some options and we're going to set Http only to true,
we're going to say secure.
Now, this I only want to be true if we're in production because you do have to have Https with this.
If you set this to true and obviously in development, we don't have Https.
So what we can do is say process dot env and then dot node underscore env and if that's not in.
Development.
Okay, So if it's not in development, meaning it's in production, then this will be true.
Okay.
Then we also want to set same site.
I think its capital S, Yeah.
Same site.
We want to set that to strict.
This will prevent attacks and then.
Let's set the max age.
So when do we want this to expire?
And I want that to be.
Since we set this to 30 days.
Let's set this to 30 days as well.
Now, this is in milliseconds, so I'm going to do 30 times.
24 times 60.
Times, 60 times 1000.
And that should be.
30 days.
All right.
And that's it.
We're not going to send any any token back.
We will send this data in case we need it, but we don't need to send the token.
It's going to get stored here and then it will get sent with every subsequent request.
You know, after we we log in.
So now let's save that.
And we do need to add this secret right here process.
Env jwt secret.
So since we're using the dot env package, we can go to our dot env file and we're going to add that.
So jwt underscore.
Secrets.
And you can set this to absolutely anything.
I'm just going to do A, B, C, one, two, three.
And I'll save that.
And then if you do have an example env, you should also add that here.
So JWT underscore secrets.
And you can say add.
I don't know.
Add your secret.
Okay.
Now when you do add something to envy, you want to restart the server.
So let's do that just so it can read it.
Okay now.
What should happen now if we try to hit this route and we know we have the right email and password
is it should create the token and it should save it in in a cookie.
And it should be we should be able to send it with every other request.
So let's go ahead and try this out.
So I have my my postman open.
I'm hitting user slash login with a post request.
I'm setting the correct email and correct password.
So let's click send.
Okay, now it worked, right?
We got our data back and now if you look right here, you'll see cookies one.
And if you check it out, we have a cookie called JWT.
All right.
Now, if we look in the headers here.
And we scroll up a little bit.
You can see this set cookie and you can see JWT equals and then it has our Json web token.
Okay.
In fact, I can grab this.
So it ends.
Right here.
That's the token.
The rest is just some information about the cookie itself.
But let's go ahead and copy that.
And then I'm going to go back to the browser and go to JWT IO and paste that in and you'll notice that.
In the payload.
We have a user ID of this six, four, three, whatever.
And if we look in our database and we look at the user that I used, John Doe, the ID is six, four,
three, whatever.
So we now have that cookie set with that user ID.
So now if we want to make a request to a protected route, which we don't have any yet, we haven't
even written the middleware to create protected routes, but we'll be able to ultimately take that cookie
and send that along with it.
All right.
So up to this point, we can at least create the Json web token, put it into an Http only cookie.
Now, in the next video, I want to create the auth middleware that will actually process that token
so we can actually have protected routes.