Authentication Done

Author: 5codeman

app.js

@@ -8,8 +8,12 @@ const app = express();
 //parse the form data sent with post request
 const bodyParser = require('body-parser');
 app.use(bodyParser.urlencoded({ extended: false }));
+
 app.use(bodyParser.json()); // It parses only json object(when any request post json data)
 
+const cookieParser = require('cookie-parser');
+app.use(cookieParser());
+
 // connect to the mysql DB
 const sequelize = require('./util/database');
 const User = require('./models/user');  // ? What is use of this

controllers/user_controller.js

@@ -49,6 +49,8 @@ module.exports.signIn = async function (req, res) {
             }
 
             else if (user && user.password == password) {
+                const token = generateAccessToken(user.id, user.email);
+                res.cookie("jwt_token", token);
                 res.status(200).send(`<script> window.location.href='/user_dashboard'; </script>`);
 
             }
@@ -63,4 +65,6 @@ module.exports.signIn = async function (req, res) {
 
 module.exports.userDashboard = function (req, res) {
     res.sendFile(path.join(__dirname, '../public/views/user_dashboard.html'));
-};
+};
+
+

middleware/auth.js

@@ -0,0 +1,34 @@
+const jwt = require("jsonwebtoken");
+const User = require("../models/user");
+
+const authenticate = (req, res, next) => {
+    try {
+        const token = req.cookies.jwt_token;
+        //suppose if token not exist in browser cookies or someone delete it
+        if (!token) {
+            res.redirect('/');
+        }
+
+        // in this user a object is return with email and the userId
+        const user = jwt.verify(token, process.env.SECRET_KEY); //It give the binded data after matching with secret_key
+
+        //suppose someone edit or alter my token in browser cokkies or cookies is not match with my secret key or vrify unsuccessful.
+        if (!user) {
+            res.redirect('/');
+        }
+
+        User.findByPk(user.userId).then((user) => {
+            //suposse that if user is not in our db or not exist
+            if (!user) {
+                res.redirect('/');
+            }
+            req.user = user; //make a user property in req
+            next(); // it goes to next action, controller
+        });
+    } catch (err) {
+        console.log(err);
+        return res.status(401).json({ success: false });
+    }
+};
+
+module.exports = authenticate;

package-lock.json

@@ -15,6 +15,7 @@
   "dependencies": {
     "axios": "^1.5.0",
     "body-parser": "^1.20.2",
+    "cookie-parser": "^1.4.6",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
     "jsonwebtoken": "^9.0.2",

package.json

@@ -350,7 +350,8 @@ logoutBtn.addEventListener("click", logout);
 
 async function logout() {
     try {
-        // localStorage.clear();
+        //delete the browser cookies
+        document.cookie = "jwt_token=; max-age=-60"; // ? Any diff. way and why we write like this ??
         window.location.href = "/";
     } catch (err) {
         console.log(err);

public/js/user_dashboard.js

@@ -1,14 +1,17 @@
 const express = require('express');
 const router = express.Router();
 
+//here userAuthentication is a middleware function
+const userAuthentication = require("../middleware/auth");
+
 const expenseController = require('../controllers/expense_controller');
 
-router.post('/addExpense', expenseController.addExpense);
+router.post('/addExpense', userAuthentication, expenseController.addExpense);
 
-router.get('/getAllExpenses', expenseController.getAllExpenses);
+router.get('/getAllExpenses', userAuthentication, expenseController.getAllExpenses);
 
-router.get('/deleteExpense/:id', expenseController.deleteExpense);
+router.get('/deleteExpense/:id', userAuthentication, expenseController.deleteExpense);
 
-router.post('/updateExpense/:id', expenseController.updateExpense);
+router.post('/updateExpense/:id', userAuthentication, expenseController.updateExpense);
 
 module.exports = router;

router/expense.js

@@ -1,6 +1,9 @@
 const express = require('express');
 const router = express.Router();
 
+//here userAuthentication is a middleware function
+const userAuthentication = require("../middleware/auth");
+
 const homeController = require('../controllers/home_controller');
 
 const userController = require('../controllers/user_controller');
@@ -11,6 +14,6 @@ router.post('/signUp', userController.signUp);
 
 router.post('/signIn', userController.signIn);
 
-router.get('/user_dashboard', userController.userDashboard);
+router.get('/user_dashboard', userAuthentication, userController.userDashboard);
 
 module.exports = router;