Appreciated your presentation and specially the remark at the end where you make us aware of this being an example to understand the mechanism, but that it should never be implemented that way. Authentication has to be made first and tokens have to be delivered. Roles should not be passed between client and server, nor username, nor userid. Based on the token the server side retrieves the userid and associated roles for the app and then performs the authorization. Greeting from Geneva.
Hi pedro i like your tutorials a lot *So can you please do another one about managing users rolls but in this with JWT and more secure also with an interface like using Ejs instead of PostMan* and i will be so thankful if you do it 💜😁
First comment ! I'm currently learning backend, i want to become a MERN developer, fullstack developer whatever, and i'm still undertanding how the backend works and videos like this one cna help me too much ! Thank you homie
Thank youu! Glad I am able to help! If I could give an advice for you that is starting to learn backend, I would advice you not to skip the fundamentals. For example, understand how an api works and the different aspects of a http request. Best of luck!
Never knew middlewares could take up arguments! Also had a qn that we should not decide the role based on the body field right because it's easy to intercept the request and change the field via proxies like burpsuite . Correct me if I am wrong. Great video :)
Excellent video Pedro. I'm using vs code and Hoppscotch. Do you have any idea why I needed to change my GET requests to POST requests to get the code to work? Really weird, I followed the tutorial to the "T". Regardless, the code works and am able to crudely authenticate.
It great video Pedro.... can u tell us more on How to set up specific secured password and username which solely authorized manage admin page....like the one asked to login into our own pc.
Hey Pedro! Can you add login with Facebook or with Google in your type-graphql series, I am really having a hard time figuring out how to do log in with Google in my project which is based on type-graphql and frontend is on nextjs.
Hey, it depends on what you are trying to do! Are you using firebase for authentication? Are you using the google and facebook api? I planned on adding a video on a manual auth system.
You can definitely use it, however you still need to save the user somewhere and find a way to maintain them authenticated for a long time. Many companies prefer it this way in order for them not to keep track of passwords!
Hey pedro, could you tell me how can i add body in request in postman, like we can't pass a body in get request how you are doing it, when i was trying to do it, i am getting error like cannot read properties of undefined 'role'.12:20
It's gr8 video as always....but i was trying to make admin with sepecific,secured password for my web pro.if u can plz help me on this.just tell me the way.thank u!
Thanks friend.... will you plan to make another video with more advanced techniques as you comment on the video? My English is bad. I use a translator... I greet you from Venezuela. I already subscribed and gave him a thumbs up... My name is Jose Grillo ESPAÑOL Gracias amigo.... tendras pensado sacar otro video con tecnicas mas avanzadas como comentas en el video? mi ingles es malo uso traductor... te saludo de Venezuela Ya me suscribi y le di manito arriba... Mi nombre es Jose Grillo
hi, just wondering but should it be more safe to have a table on the backend database which contains users' roles/courses enrolled instead of validating against the body of the client that anyone can modify?
Actually, what you'd do in a more realistic (production-ready) approach is to have the user role(s) set in her profile in the DB by an admin or the like. Then, when the server spawns a session (stateful-) or issues a JWT (stateless authentication), that or those roles are attached to the session or written inside the JWT. In the latter case, the token can't be messed with (e.g. up the user roles) cause that'll break the encryption and hence invalidate the token. Pedro's example is didactic and beginner-friendly, but it's a big _no no_ as you guys spotted yourselves.
I never new middle ware functions could take arguments. I quess we learn everyday. Thanks 👍
I found out about this a couple months ago hahaha was surprised too!
actually, that function is not a middleware but, is returning a middleware upon calling in the app.get
This is what I’ve been waiting for. Thank You
Happy to help! I am glad you liked the video!
i've downloaded it and will watch it when my exams gets over.❤️❤️❤️❤️
Hahaha thank you for the support! Im going through exams too! Good luck!
Appreciated your presentation and specially the remark at the end where you make us aware of this being an example to understand the mechanism, but that it should never be implemented that way. Authentication has to be made first and tokens have to be delivered. Roles should not be passed between client and server, nor username, nor userid. Based on the token the server side retrieves the userid and associated roles for the app and then performs the authorization.
Greeting from Geneva.
Hi pedro i like your tutorials a lot *So can you please do another one about managing users rolls but in this with JWT and more secure also with an interface like using Ejs instead of PostMan*
and i will be so thankful if you do it 💜😁
Pedro lançou a braba mesmo! Congrats my friend!
First comment !
I'm currently learning backend, i want to become a MERN developer, fullstack developer whatever, and i'm still undertanding how the backend works and videos like this one cna help me too much ! Thank you homie
Thank youu! Glad I am able to help! If I could give an advice for you that is starting to learn backend, I would advice you not to skip the fundamentals. For example, understand how an api works and the different aspects of a http request. Best of luck!
@@PedroTechnologies Thanks My Man
ooohh, thank you Pedro. This is useful and fun to manage different sutf with the api rest
Thank you! Glad you liked the video!
I love this guy, makes everything I need to know easier to understand
thank you. there is a way in how you connect things. sometimes noobs like me get over whelmed when we see an error.
Very underrated video. Much Love ❤️
Thank you!! 😊
BR representando :)
I am your 100,00oth subscriber!!!! Let me know when you get the plague. Congratulations.
It's so very understand, thanks for this perfect video
you should be #1 on top for web dev videos.
great tutorial! thank you so much!
Best coding channel
Hahaha thank you so much for the support!
Never knew middlewares could take up arguments! Also had a qn that we should not decide the role based on the body field right because it's easy to intercept the request and change the field via proxies like burpsuite . Correct me if I am wrong. Great video :)
The role should be given upon sign up, or some subscription. In real world you'll never send role with the body.
Excellent video Pedro. I'm using vs code and Hoppscotch. Do you have any idea why I needed to change my GET requests to POST requests to get the code to work? Really weird, I followed the tutorial to the "T". Regardless, the code works and am able to crudely authenticate.
Amazing explication.
Thank you buddy!
Any time!
It great video Pedro.... can u tell us more on How to set up specific secured password and username which solely authorized manage admin page....like the one asked to login into our own pc.
I been looking for this kind of simple clarity. No pompous nonsense. Just pertinent information.
Great stuff. Thanks
thank u so much concept clear
Love the explanation on each little element of the code. This helped a lot for a beginner like me. Keep it up! Thank you for the great work!
Thanks Pedro
Hey Pedro! Can you add login with Facebook or with Google in your type-graphql series, I am really having a hard time figuring out how to do log in with Google in my project which is based on type-graphql and frontend is on nextjs.
Hey, it depends on what you are trying to do! Are you using firebase for authentication? Are you using the google and facebook api? I planned on adding a video on a manual auth system.
@@PedroTechnologies no firebase just normal session authentication with cookies and just want to add google login or facebook.
Thanks a lot for this, bro!
Class 420, present
Thank you bro... I want to ask, can we use social media authentication like google/fb for REST API? I don't know how to implement it to rest api
You can definitely use it, however you still need to save the user somewhere and find a way to maintain them authenticated for a long time. Many companies prefer it this way in order for them not to keep track of passwords!
But what if I change the role in the body that’s passed? This is a very bad security
cool video thx. dont u have pls the code posted for this somewhere?
Hey pedro, could you tell me how can i add body in request in postman, like we can't pass a body in get request how you are doing it, when i was trying to do it, i am getting error like cannot read properties of undefined 'role'.12:20
Great video !
I start your videos with a like
great
in min 10 you use currying.... so it is FP style... thats cool
It's gr8 video as always....but i was trying to make admin with sepecific,secured password for my web pro.if u can plz help me on this.just tell me the way.thank u!
Thank you Pedro how to become a mern developer it is not easy to me to master it
when user role updated how to manage jwt?
athorization goood
Hey, I just found your channel and it has impressive contents...Would you please help me with implementing guest mode feature for my website ?
Thanks friend.... will you plan to make another video with more advanced techniques as you comment on the video?
My English is bad. I use a translator... I greet you from Venezuela.
I already subscribed and gave him a thumbs up... My name is Jose Grillo
ESPAÑOL
Gracias amigo.... tendras pensado sacar otro video con tecnicas mas avanzadas como comentas en el video?
mi ingles es malo uso traductor... te saludo de Venezuela
Ya me suscribi y le di manito arriba... Mi nombre es Jose Grillo
Top. Cadê o código Pedrão?
can we have source code
leo needs a tutor
"pedro who obviously got a 100 " ...lol ...liked the video for this humourXD
Lmaoo gotta stay humble
lol.. i got 100 on Software Requirement Engineering course
Bom inglês.
hi, just wondering but should it be more safe to have a table on the backend database which contains users' roles/courses enrolled instead of validating against the body of the client that anyone can modify?
I also commented the same thing LOL :)
Actually, what you'd do in a more realistic (production-ready) approach is to have the user role(s) set in her profile in the DB by an admin or the like. Then, when the server spawns a session (stateful-) or issues a JWT (stateless authentication), that or those roles are attached to the session or written inside the JWT. In the latter case, the token can't be messed with (e.g. up the user roles) cause that'll break the encryption and hence invalidate the token. Pedro's example is didactic and beginner-friendly, but it's a big _no no_ as you guys spotted yourselves.
code source ?