Presenter: In the last section,
we started wiring up our JWT strategy.
As a reminder, strategies are plugins
of sorts that work with Passport.
Passport is a library that we use to figure out
whether or not a user is currently authenticated to
use our application.
In a strategy, attempts to authenticate that user
in a very particular fashion.
So we're using JWTs for authentication.
So we grabbed a strategy to help us
with JWT authentication and Passport.
We created a new JWT strategy
and passed a call back into it.
That's going to be ran whenever a request comes across
or into our application containing a JWT.
Once this function is ran,
we're going to try to find a user ID
with the ID that is contained within the token.
Remember, the token contains some amount
of encoded data that we set up already
inside of our authentication controller right here
when we encoded the JWT.
If we were able to find a user
then we called the done callback with that particular user.
Otherwise, we said nope, we didn't find a user
and we passed false as the second argument to done.
The last thing we have to do is fill out these JWT options.
So there's kinda a little magic that's going
on the behind the scenes here.
Number one, you know, we're expecting
that this JWT strategy is going to somehow get access
to our JWT off the request, right?
We're assuming that somehow it's going to look
through the entire request
and it's just gonna figure out, okay
this is where the JWT is on the request.
But a JWT token can sit anywhere on the request.
It can be contained within the body,
it can be within the URL,
it can be on the headers of the request.
And so we have to specifically tell this strategy
where to look on request to find this key.
So to tell it where to look,
we're going to pass it an option called JWT from request
and we're gonna tell it extract the token
from a header called Authorization.
So right now, or right here with this line, Oops
I put a semicolon on.
Don't want that.
With this line right here, we're telling JWT strategy
that whenever a request comes in
and we want Passport to handle it,
it needs to look at the request's header
and specifically a header called authorization
to find the token.
Okay, so that's step one.
The other piece of setup that we have to do in here,
the other option that we're gonna pass in,
you'll notice that we assumed that
the payload would just mysteriously pop up in here, right?
Like the decoded payload.
And as we discussed before, when we create a payload,
we are encoding it with some very particular secret.
So whenever we use JWT strategy,
we also have to tell it the secret
that it should use to decode this token.
So as a second argument, I'll say secret or key
and that's gonna be config.secret.
Remember, we already imported config up here at the top.
Okay, So let's save this.
I'm gonna go over and check my terminal.
Verify. Yep.
Everything is still green over here.
At this point in time, we've now set up our JWT strategy.
The last thing we have to do is tell Passport
to actually use this strategy.
So we have to, you know, there's no magic going on here.
We have to wire up everything together.
So to tell Passport to use this strategy,
we just have to say passport.use JWT login.
And this variable right here, remember we created it.
That was the name of the strategy that we created.
So at this point, we've now told Passport, "Hey
be sure to use this very particular strategy right here."
All right, this looks good.
Let's continue the next section where
we will put this strategy to use
and try to make an authenticated request.