Appreciated your presentation and specially the remark at the end where you make us aware of this being an example to understand the mechanism, but that it should never be implemented that way. Authentication has to be made first and tokens have to be delivered. Roles should not be passed between client and server, nor username, nor userid. Based on the token the server side retrieves the userid and associated roles for the app and then performs the authorization. Greeting from Geneva.
First comment ! I'm currently learning backend, i want to become a MERN developer, fullstack developer whatever, and i'm still undertanding how the backend works and videos like this one cna help me too much ! Thank you homie
Thank youu! Glad I am able to help! If I could give an advice for you that is starting to learn backend, I would advice you not to skip the fundamentals. For example, understand how an api works and the different aspects of a http request. Best of luck!
Hi pedro i like your tutorials a lot *So can you please do another one about managing users rolls but in this with JWT and more secure also with an interface like using Ejs instead of PostMan* and i will be so thankful if you do it 💜😁
Hey pedro, could you tell me how can i add body in request in postman, like we can't pass a body in get request how you are doing it, when i was trying to do it, i am getting error like cannot read properties of undefined 'role'.12:20
You can definitely use it, however you still need to save the user somewhere and find a way to maintain them authenticated for a long time. Many companies prefer it this way in order for them not to keep track of passwords!
Never knew middlewares could take up arguments! Also had a qn that we should not decide the role based on the body field right because it's easy to intercept the request and change the field via proxies like burpsuite . Correct me if I am wrong. Great video :)
Excellent video Pedro. I'm using vs code and Hoppscotch. Do you have any idea why I needed to change my GET requests to POST requests to get the code to work? Really weird, I followed the tutorial to the "T". Regardless, the code works and am able to crudely authenticate.
Hey Pedro! Can you add login with Facebook or with Google in your type-graphql series, I am really having a hard time figuring out how to do log in with Google in my project which is based on type-graphql and frontend is on nextjs.
Hey, it depends on what you are trying to do! Are you using firebase for authentication? Are you using the google and facebook api? I planned on adding a video on a manual auth system.
It great video Pedro.... can u tell us more on How to set up specific secured password and username which solely authorized manage admin page....like the one asked to login into our own pc.
It's gr8 video as always....but i was trying to make admin with sepecific,secured password for my web pro.if u can plz help me on this.just tell me the way.thank u!
hi, just wondering but should it be more safe to have a table on the backend database which contains users' roles/courses enrolled instead of validating against the body of the client that anyone can modify?
Actually, what you'd do in a more realistic (production-ready) approach is to have the user role(s) set in her profile in the DB by an admin or the like. Then, when the server spawns a session (stateful-) or issues a JWT (stateless authentication), that or those roles are attached to the session or written inside the JWT. In the latter case, the token can't be messed with (e.g. up the user roles) cause that'll break the encryption and hence invalidate the token. Pedro's example is didactic and beginner-friendly, but it's a big _no no_ as you guys spotted yourselves.
Thanks friend.... will you plan to make another video with more advanced techniques as you comment on the video? My English is bad. I use a translator... I greet you from Venezuela. I already subscribed and gave him a thumbs up... My name is Jose Grillo ESPAÑOL Gracias amigo.... tendras pensado sacar otro video con tecnicas mas avanzadas como comentas en el video? mi ingles es malo uso traductor... te saludo de Venezuela Ya me suscribi y le di manito arriba... Mi nombre es Jose Grillo
This is what I’ve been waiting for. Thank You
Happy to help! I am glad you liked the video!
Appreciated your presentation and specially the remark at the end where you make us aware of this being an example to understand the mechanism, but that it should never be implemented that way. Authentication has to be made first and tokens have to be delivered. Roles should not be passed between client and server, nor username, nor userid. Based on the token the server side retrieves the userid and associated roles for the app and then performs the authorization.
Greeting from Geneva.
I never new middle ware functions could take arguments. I quess we learn everyday. Thanks 👍
I found out about this a couple months ago hahaha was surprised too!
actually, that function is not a middleware but, is returning a middleware upon calling in the app.get
I been looking for this kind of simple clarity. No pompous nonsense. Just pertinent information.
First comment !
I'm currently learning backend, i want to become a MERN developer, fullstack developer whatever, and i'm still undertanding how the backend works and videos like this one cna help me too much ! Thank you homie
Thank youu! Glad I am able to help! If I could give an advice for you that is starting to learn backend, I would advice you not to skip the fundamentals. For example, understand how an api works and the different aspects of a http request. Best of luck!
@@PedroTechnologies Thanks My Man
i've downloaded it and will watch it when my exams gets over.❤️❤️❤️❤️
Hahaha thank you for the support! Im going through exams too! Good luck!
ooohh, thank you Pedro. This is useful and fun to manage different sutf with the api rest
Thank you! Glad you liked the video!
I love this guy, makes everything I need to know easier to understand
Hi pedro i like your tutorials a lot *So can you please do another one about managing users rolls but in this with JWT and more secure also with an interface like using Ejs instead of PostMan*
and i will be so thankful if you do it 💜😁
Very underrated video. Much Love ❤️
Thank you!! 😊
I am your 100,00oth subscriber!!!! Let me know when you get the plague. Congratulations.
Hey pedro, could you tell me how can i add body in request in postman, like we can't pass a body in get request how you are doing it, when i was trying to do it, i am getting error like cannot read properties of undefined 'role'.12:20
thank you. there is a way in how you connect things. sometimes noobs like me get over whelmed when we see an error.
Pedro lançou a braba mesmo! Congrats my friend!
you should be #1 on top for web dev videos.
this saved my life thank you 💗
It's so very understand, thanks for this perfect video
Best coding channel
Hahaha thank you so much for the support!
Thank you bro... I want to ask, can we use social media authentication like google/fb for REST API? I don't know how to implement it to rest api
You can definitely use it, however you still need to save the user somewhere and find a way to maintain them authenticated for a long time. Many companies prefer it this way in order for them not to keep track of passwords!
Love the explanation on each little element of the code. This helped a lot for a beginner like me. Keep it up! Thank you for the great work!
Never knew middlewares could take up arguments! Also had a qn that we should not decide the role based on the body field right because it's easy to intercept the request and change the field via proxies like burpsuite . Correct me if I am wrong. Great video :)
The role should be given upon sign up, or some subscription. In real world you'll never send role with the body.
Excellent video Pedro. I'm using vs code and Hoppscotch. Do you have any idea why I needed to change my GET requests to POST requests to get the code to work? Really weird, I followed the tutorial to the "T". Regardless, the code works and am able to crudely authenticate.
Hey Pedro! Can you add login with Facebook or with Google in your type-graphql series, I am really having a hard time figuring out how to do log in with Google in my project which is based on type-graphql and frontend is on nextjs.
Hey, it depends on what you are trying to do! Are you using firebase for authentication? Are you using the google and facebook api? I planned on adding a video on a manual auth system.
@@PedroTechnologies no firebase just normal session authentication with cookies and just want to add google login or facebook.
It great video Pedro.... can u tell us more on How to set up specific secured password and username which solely authorized manage admin page....like the one asked to login into our own pc.
great tutorial! thank you so much!
cool video thx. dont u have pls the code posted for this somewhere?
It's gr8 video as always....but i was trying to make admin with sepecific,secured password for my web pro.if u can plz help me on this.just tell me the way.thank u!
But what if I change the role in the body that’s passed? This is a very bad security
Amazing explication.
Great stuff. Thanks
when user role updated how to manage jwt?
Top. Cadê o código Pedrão?
thank u so much concept clear
Thank you buddy!
Any time!
Hey, I just found your channel and it has impressive contents...Would you please help me with implementing guest mode feature for my website ?
Great video !
I start your videos with a like
BR representando :)
Thanks a lot for this, bro!
Class 420, present
Thank you Pedro how to become a mern developer it is not easy to me to master it
hi, just wondering but should it be more safe to have a table on the backend database which contains users' roles/courses enrolled instead of validating against the body of the client that anyone can modify?
I also commented the same thing LOL :)
Actually, what you'd do in a more realistic (production-ready) approach is to have the user role(s) set in her profile in the DB by an admin or the like. Then, when the server spawns a session (stateful-) or issues a JWT (stateless authentication), that or those roles are attached to the session or written inside the JWT. In the latter case, the token can't be messed with (e.g. up the user roles) cause that'll break the encryption and hence invalidate the token. Pedro's example is didactic and beginner-friendly, but it's a big _no no_ as you guys spotted yourselves.
Thanks Pedro
can we have source code
in min 10 you use currying.... so it is FP style... thats cool
great
code source ?
Thanks friend.... will you plan to make another video with more advanced techniques as you comment on the video?
My English is bad. I use a translator... I greet you from Venezuela.
I already subscribed and gave him a thumbs up... My name is Jose Grillo
ESPAÑOL
Gracias amigo.... tendras pensado sacar otro video con tecnicas mas avanzadas como comentas en el video?
mi ingles es malo uso traductor... te saludo de Venezuela
Ya me suscribi y le di manito arriba... Mi nombre es Jose Grillo
leo needs a tutor
athorization goood
"pedro who obviously got a 100 " ...lol ...liked the video for this humourXD
Lmaoo gotta stay humble
lol.. i got 100 on Software Requirement Engineering course
Bom inglês.