This tutorial is a continuation of the previous tutorial that is Consuming JWT API with MongoDB and Node.js. We will make auth with the help of JWT(JSON Web Token). But before we create the JWT token, we need to create a routing APIto login and validate the login.
To make the API routing more neat. we can make a prefix /api, to differentiate routing API and other routing.
example:
// make prefix
app.use('/api',router);
router.post('/login',function(req, res){
});
app.use('/api',router): We can create a prefix with the use () function, the first parameter is the name of the prefix and the second is the initialization that will be in use. to replace app.
router.post(): to post we can use the post () function on the route.
Make Validation Login
We will create a login consisting of email and password. The first step that we do is matching email in the database with email data in POST by a user. We can use the function of the mongoose. That is findOne ().
Example:
user.findOne({
email: req.body.email
}, function(err,user){
//you can see the result in this section
})
findOne(): findOne() has two objects. the first object is the data to be in match with the database, and the second object is a function that has two parameters( error , resultdata ).
function(err,user): This function has two uses. to see errors if data does not match. and for if the data will be thrown into the second parameter. err and userare just the name of a parameter.
Handle validation result
We can validate the user parameters in the function (err, user). As already described above. This function has the first two parameters containing the error, and the second is the user data. If an error occurs we can directly throw if (err) throw err.
Example :
function(err,user){
if(err) throw err;
if(!user){
res.json({
success: false,
message: 'User not found'
})
}
})
if (err) throw err; : With err parameter. if an error occurs we can throw error.
if (! user) {}: with user parameter we can validate if user does not exist (! user)
res.json (): we can give respone in JSON form, with res.json () and make object as its parameter {key1: value1, key2: value2}.
Handle Password not match
We can do further validation if the user is found. we can match the password in the user input with the password in the database.
Example:
Example:
if(!user){
res.json({
success: false,
message: 'User not found'
})
}else{
if(user.password != req.body.password){
res.json({
success: false,
message: 'Wrong password'
})
}
}
After the email and password from the user has successfully passed the validation. we can just straighten the JWT token in the {else} section of if (user.password! = req.body.password) {}. We can create a token with the sign () method of JWT.
Example:
Example:
if(user.password != req.body.password){
res.json({
success: false,
message: 'Wrong password'
})
}else{
// create token
var token = jwt.sign(user, app.get('secretKey'),{
expiresIn: "24h"
});
// return token
res.json({
success : true,
message : 'Token has been created',
token : token
})
}
Then we can save the token in a variable in this tutorial that variable is var token. Once we have succeeded to parse the token we can see it with the return token in JSON.
res.json({
success : true,
message : 'Token has been created',
token : token
})
var express = require('express');
var bodyParser = require('body-parser');
var mongoose = require('mongoose');
var jwt = require('jsonwebtoken');
var app = express();
var router = express.Router();
var cors = require('cors');
var config = require('./app/config');
var user = require('./app/models/user');
var port = 3000;
app.use(bodyParser.urlencoded({extended:false}));
app.use(bodyParser.json());
mongoose.connect(config.database);
app.set('secretKey', config.secret);
app.use(cors());
// make prefix
app.use('/api',router);
router.post('/login',function(req, res){
user.findOne({
email: req.body.email
}, function(err,user){
if(err) throw err;
if(!user){
res.json({
success: false,
message: 'User not found'
})
}else{
if(user.password != req.body.password){
res.json({
success: false,
message: 'Wrong password'
})
}else{
// create token
var token = jwt.sign(user, app.get('secretKey'),{
expiresIn: "24h"
});
// return token
res.json({
success : true,
message : 'Token has been created',
token : token
})
}
}
})
});
app.listen(3000);
We have successfully validated the user and managed to get the token. in the next tutorial I will use a token to verify the user who is logged in and get the user data.