1
00:00:00,790 --> 00:00:01,990
In this video.

2
00:00:01,990 --> 00:00:07,450
Let's go ahead and create the controller to allow a user to log in.

3
00:00:07,720 --> 00:00:10,030
So this is a look in logic.

4
00:00:10,210 --> 00:00:16,720
We are going to take the email and then the password the user is trying to send to our server.

5
00:00:16,720 --> 00:00:24,310
And our server will send that request to the database and check if there is a user with a particular

6
00:00:24,310 --> 00:00:26,080
email or password.

7
00:00:26,080 --> 00:00:31,900
So let's see how we are going to implement that inside the controllers and for users.

8
00:00:32,259 --> 00:00:37,270
Now let's collapse the register and let's work with the log in.

9
00:00:37,330 --> 00:00:42,890
So first step is that we are going to check if the email exists.

10
00:00:42,910 --> 00:00:50,590
So let's go ahead and then this structure, the things that we need to send to our server as rec, the

11
00:00:50,590 --> 00:00:54,700
body, email and the password.

12
00:00:55,270 --> 00:00:56,290
So here we go.

13
00:00:56,290 --> 00:01:08,350
Const we're going to be as user found is equal to a weight and bring in the user model dot find one

14
00:01:08,950 --> 00:01:11,740
and we want to find by email.

15
00:01:12,490 --> 00:01:21,050
So here, if a user is not found, then it means that there is no user with that particular email.

16
00:01:21,070 --> 00:01:24,520
So here we can go ahead and return an error.

17
00:01:24,520 --> 00:01:33,940
For the meantime, let's return this message as the kind of error, but it is not and let's provide

18
00:01:33,940 --> 00:01:36,490
as invalid email.

19
00:01:40,480 --> 00:01:41,320
Perfect.

20
00:01:41,350 --> 00:01:51,070
The next step is that we need to verify the user password because we say the random string of characters

21
00:01:51,070 --> 00:01:53,560
and we can not remember that.

22
00:01:53,560 --> 00:02:02,140
And the package copy creates make it pretty easy for us to verify and get back the actual password we

23
00:02:02,140 --> 00:02:02,680
used.

24
00:02:02,770 --> 00:02:09,039
So in here we are going to create a variable called a password valid.

25
00:02:10,710 --> 00:02:14,550
And it's equal to a weight we create.

26
00:02:14,550 --> 00:02:16,170
Don't compare.

27
00:02:16,200 --> 00:02:26,400
We are going to compare the we are going to compare the plane password and then the password being saved

28
00:02:26,400 --> 00:02:32,400
inside our DB and we can have it on the user found dot password.

29
00:02:36,070 --> 00:02:44,290
This function is going to return true if there is a password being hashed with the password we are sending

30
00:02:44,290 --> 00:02:49,690
or passing in and it's going to return false if it doesn't match.

31
00:02:49,810 --> 00:02:57,620
So here we are going to throw an error if it's not true or meaning if it's not valid.

32
00:02:57,640 --> 00:03:03,070
So we are going to return the error as that here.

33
00:03:03,100 --> 00:03:04,900
And here we can say that.

34
00:03:04,900 --> 00:03:07,060
Invalid password.

35
00:03:07,510 --> 00:03:08,250
All right.

36
00:03:08,470 --> 00:03:10,720
But we have some problem here.

37
00:03:10,720 --> 00:03:14,300
And that is the kind of message that we are sending back.

38
00:03:14,320 --> 00:03:21,970
So let's say that a user is trying to hack or log in in the name of somebody and you provide this details,

39
00:03:21,970 --> 00:03:23,690
for example, invalid email.

40
00:03:23,710 --> 00:03:27,170
In that way we are giving more hand to the hacker.

41
00:03:27,190 --> 00:03:33,010
So to avoid that, let's make use of invalid log in credentials.

42
00:03:34,310 --> 00:03:41,390
In that way, the car might not be able to know whether the email or the password is invalid or not.

43
00:03:43,060 --> 00:03:44,440
So here you go.

44
00:03:44,530 --> 00:03:51,580
So at this point, we can go ahead and then send back the user found as user found.

45
00:03:51,580 --> 00:03:55,240
And here is going to be the data that we want to send.

46
00:03:55,570 --> 00:04:03,000
So let's get back to the tender client and log in and let's see if we'd be able to log in.

47
00:04:03,010 --> 00:04:05,680
So let's provide the email.

48
00:04:07,460 --> 00:04:08,390
John.

49
00:04:09,550 --> 00:04:11,680
At gmail.com.

50
00:04:12,370 --> 00:04:19,029
And then the password is going to be one, two, three, four, five, and let's hit send.

51
00:04:19,480 --> 00:04:22,450
And you can see that we go back the user.

52
00:04:22,750 --> 00:04:30,040
If I temper the email something like this, you can see that we go back this morning.

53
00:04:30,040 --> 00:04:36,610
We are not handling the error where like I said, you're going to have a section for error handling.

54
00:04:36,610 --> 00:04:40,150
For the meantime, let's maintain it as it is.

55
00:04:40,480 --> 00:04:42,760
So now the log in is working.

56
00:04:42,760 --> 00:04:51,730
But what has left is that as soon as a user log in, our server does not remember the log in user.

57
00:04:51,730 --> 00:04:55,240
That's the behavior of HTTP servers.

58
00:04:55,240 --> 00:05:02,830
So we need to find a way to tell the server that hey server this particular user has log in, so allow

59
00:05:02,830 --> 00:05:06,880
him or her to take any action in our application.

60
00:05:06,880 --> 00:05:08,620
That's what we are going to do.

61
00:05:08,620 --> 00:05:11,050
And this what we call authorization.

62
00:05:11,320 --> 00:05:18,760
So for this one we are going to use what is called express session for the other project, that is the

63
00:05:18,760 --> 00:05:21,550
expenses Tracker Application API.

64
00:05:21,580 --> 00:05:24,880
We use what is called JSON with token.

65
00:05:24,880 --> 00:05:28,930
So let's see how we are going to implement express session.