JWT Authentication Tutorial - Node.js

Подписаться 1,6 млн

Просмотров 1 млн

50% 1

JSON web tokens are one of the more popular ways to secure applications, especially in micro-services, but JWT is much more complex than a simple session based user authentication. In this video I will be breaking down exactly how to set up authentication with JWT and how to ensure the authentication is secure. I will also be showing how to setup refresh tokens with JWT so that your application is even more resilient and secure. Lastly, I will show how to invalidate refresh tokens which is the ultimate last step in securing an application.
📚 Materials/References:
User Authentication Video: • Build Node.js User Aut...
JWT Explained Video: • What Is JWT and Why Sh...
GitHub Code: github.com/Web...
🧠 Concepts Covered:
- Creating Node.js authentication middleware
- Using refresh tokens with JWT
- Authenticating users with JWT
- Invalidating refresh tokens to log users out
- How to use JWT securely
🌎 Find Me Here:
My Courses: courses.webdev...
Patreon: / webdevsimplified
Twitter: / devsimplified
Discord: / discord
GitHub: github.com/Web...
CodePen: codepen.io/Web...
#JWT #WDS #Authentication

Опубликовано:

19 сен 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 879

@RasmusSchultz Год назад

If you're building your own authentication system, it's a really good idea to include a flag in your payloads, to indicate whether that token was generated by authenticating with user credentials, or by using a refresh token. You can use this flag to authorize sensitive operations, such as changing your password or making payments - so if the user didn't log in recently, you can prompt them to log in again for sensitive operations. I would say this is a must for most applications.

@abdulazeez.98 Год назад

I’ve encountered this in some websites. Nice to know how it was implemented.

@duythinh252 Год назад

What a great information right there! Thank you for sharing. I immediately recognize the use of the flag in payload when I changing my facebook password for example, it requests me to re-enter my password again for authenticating with user credential

@aynuayex Год назад

ya.we love to see how we can implement that.

@shahreazneeloy2119 Год назад

You have a RU-vid channel. Please make a video on this topic

@mohammadalaaelghamry8010 Год назад

Thanks for the note. it helped me.

@SuperRockthing 5 лет назад

I discovered your channel 30 minutes ago and I have already subscribed. Your way of explaining things with minimum jargon and straight forward approach is so refreshing.Keep up the good work!

@WebDevSimplified 5 лет назад

Thank you so much! My goal with the channel is to teach the most amount of content in the least amount of time, since time is the most valuable resource we have.

@serkanakman9945 4 года назад

@@WebDevSimplified that is what makes you and your channel great!

@phani123d 4 года назад

@@WebDevSimplified great

@raymondyoo5461 3 года назад

totally agree :)

@mosesegboh Год назад

True. He is one of the best ones.

@aram5642 3 года назад

The single tutorial a dev should ever watch to get their heads wrapped around auth. Great pace and flow, pure English, pleasure to watch and listen to!

@HamKibz 4 года назад

It took me only 27 minutes to understand a simple concept that has been overly complicated by some bloggers. Thanks man, that was great.

@ocoocososococosooooosoococoso 3 года назад

I'm from South Korea, Kyle explains in a concise and straight plus simple easy way which makes me understand way better than Udemy courses.

@tinnyw2 3 года назад

Kyle has an amazing talent for teaching and this demystifies a lot of how to implement JWTs on the server end. If I may, one caveat I would add is adding access and refresh tokens in the body payload may be prone to being stolen in an XSS attack and depending on how secure you would like to make your site you might want to instead store them on http-only & secure cookies with a samesite set to at least lax so they're not read by Javascript and easily stolen. Again, this tutorial is on point on so many levels and amazing!

@3042640426 2 года назад

Do you have any solution for that? Thx

@AlanJoelSchneider Месяц назад

@@3042640426 Store tokens in cookies with http-only, secure and same-site

@ROCKEFELLAPRODUCTIONS 4 года назад

You nailed these tutorials! I actually understand what you are explaining. You don't dilute it with unnecessary lingo in an attempt to sound smart. Thank you!

@chaop4o878 4 года назад

I am so close to start crying of joy. I just spent so long trying to figure this out and then I found this video. Thank you so much. Honestly, you make my favourite tutorials.

@aubz9924 4 года назад

Kyle, it would be amazing if you could make a video on how to handle JWTs on the client-side, particularly in React, in order to close the loop on this topic. As always, awesome video :)

@aspected 4 года назад

I second this! I think Ben Awad made a video about that but doesn't go into much detail

@robertjif6337 4 года назад

I want to see this too, wanna know if what I'm implementing is actually correct

@Robd515 4 года назад

Funny, I'm coming to this video because I know how to implement it with React and not without it. I learned through Brad Travery so you may want to look through his videos.

@doberman7 3 года назад

@@Robd515 could you share an URL?

@adityanair3566 3 года назад

@Kyle, please see this comment! Awesome work man, you are giving immense value to society.

@number1neek 3 года назад

Great video as always! Just wanted point out that what's being covered here is called authorization, not authentication. Authentication is when you confirm a user's identity and authorization is giving that user access to parts of the website

@lahiruudayanga5989 4 года назад

Damn this is amazing. Wasted 4 hours watching shitty videos and then came through this. Just 30 mins and everything well explained on point. Thanks a lot bro. You got a new subscriber!!!

@WebDevSimplified 4 года назад

Thank you so much!

@samgram5122 4 года назад

You blink a lot, but holy crap! You speak so clearly and teach so well without any cuts! AMAZING! Thank you so much!

@AwkworldStudios 4 года назад

Thanks for making this! Fun fact for anyone else watching: you can configure dotenv from your package.json scripts so that you don't have to write require in every file by using the -r flag and dotenv/config like so: "scripts": { "dev": "nodemon -r dotenv/config index.js" },

@vinaydixit81 4 года назад

Everything is good. But i would suggest you to be little slow when you do the code.

@dheerendrapratapsingh9406 Месяц назад

I come to your channel to learn one thing and most of the time I learn 2-4 new things for sure.. Thankyou..You are one the best teachers..Love from INDIA..🇮🇳🇮🇳🇮🇳

@drteeth11 5 лет назад

Yoooo, I just found your channel this week and wanted to let you know I love your content. Super informative, clear explanations, all around great videos. Keep up the good work!

@WebDevSimplified 5 лет назад

Thank you so much! I hope my future videos are just as useful.

@BrunoWinck 4 года назад

same :) feeling very lucky

@rajeshjamnadas 4 года назад

No nonsense just straight to the point. Clear and precise explanation. Thanks you for time for a good tutorial, cheers!

@XiagraBalls 2 года назад

Your tutorials are some of the best on YT and I watch a LOT of programming tutorials! 👍🏻👍🏻👍🏻👍🏻👍🏻 🌟🌟🌟🌟🌟

@juanetehOK 24 дня назад

i was looking for one day some simple explanation like this for jwt usage, thanks a LOT!

@CodeDreamer68 2 года назад

Thanks for keeping it simple! You are living up to your name. I watched 5 other jwt videos from well-known vloggers, and was still left confused. This one was spot on. I get it now. Thanks!

@majoulwa 4 года назад

Hi, I would particularly like to praise your clear explanations and your super clear pronunciation. So it is very easy to understand, even for someone like me, who doesn't have a lot of experience in English and who often has trouble following English-language content with a strong accent. Really great!

@PaweAndruszkow 3 года назад

this is how code tutorial video should look like! Simply, precize, no overtalking, just exact content we need, very good job!

@juhandvan 3 года назад

Kyle is a really good teacher. His tutorials helping me a better developer.

@VishalKumar-dv6qj 2 года назад

Everything was straight-forward and on-point. One question arises - Why we need to create a refresh token when we can delete the previous access token when user logs out? In that way he will not be able to use that access token forever

@brianchandler3346 3 года назад

The absolute clearest tutorial I've ever seen on the topic. I wish I had found this earlier.

@STUPIDYOUTUBE_HIDINGMSGS 2 года назад

This is the cleanest for me: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-YocRq-KesCM.html

@mykolakecha 2 года назад

This is probably the first time I'm writing a comment to a video. The reason - just wanted to acknowledge the quality of content. Especially how nice & simple everything is explained.

@ryanlarge6296 Год назад

Thank you Kyle for another great video!! Especially by making some confusing topics much clearer and understandable in such little time. I think that many of us could benefit a thousand times more from this jwt knowledge if you created a sequel to this video, or even simply a separate video all together explaining how this backend logic is tied in with the front end via a js framework or keeping it simple like ejs or regular html. There is not a whole lot of good quality educational videos or documentation covering how it can all be connected and implemented into a true fullstack application. It took me a very long time to figure out how to serve my front end as well as authenticate users with jwt using ejs. I would love to see a good video on this from you. Thank you again!

@quietnix 3 года назад

Man, this is the most efficient tutorial on the topic. Where is your applause button dude.

@SaadShah1133 3 года назад

I tried to implement JWT by watching different tutorials but i couldnt understand it, your video was the only video i understood, best node js videos keep it up; great work

@JamesQQuick 4 года назад

You're the JWT mastermind :)

@nejitawo9657 4 года назад

In just 30 mins i've learned what a ton of books couldn't explain clearly.

@juraev0056 4 года назад

You must be reading a wrong book

@hagenlens1403 4 года назад

@@juraev0056 Probably

@snoowwe 4 года назад

Sometimes you just need to see it in action to understand it. I learn math better by example than by reading theory.

@jawad9757 4 года назад

Is reading books about programming a thing? I mean it would be good for something like assembly or c or c++ but defo not for anything that is related to js

@juraev0056 4 года назад

@@jawad9757 I think it is good to read about best practices and design patterns regarding any programming language

@lordrampenthump422 2 года назад

Its really hard to explain how valuable this channel is to me. Thank you for existing

@User-null00 2 месяца назад

11/10 video. I just implemented this for a rock climbing app i'm creating. Tomorrow I will figure out how to manage the keys in my database rather than in the program.

@divyanshubhatnagar4601 3 года назад

Have to say this was short and loaded with information. I really liked the part where you also explained the Auth and Resource server. Really appreciate the content :)

@raisedbyreels 3 года назад

Yeah, I appreciate tutorials like this, a perfect blend of explanation and implementation. Thanks a million!

@ghilmanfatih9751 3 года назад

certified beginner-friendly enlighten my noob jwt knowledge in less than an hour

@qintotgroup 2 года назад

Where have you been all my life Bro. --- THANK YOU for making my job eaaaaaaasy.

@ni_kabiu_john Год назад

Who said pretty men can't code... man thanks sooooo much for this.. i 'have been afraid of backend dev, but now i learning smoothly..

@garrafromsand 3 года назад

Very distinct skill of explanation, could not be more lucid than this, 2 days of here and there in 20 min

@jonnjon1 2 года назад

I spent days trying to implement this with passport and didn't succeed. But with your help, I managed to do the same in a couple hours , Thanks a lot!!!

@chronosoutoftime6685 3 года назад

this is a very good starting point, but in my opinion it misses some parts: - first if the client refreshes, since you are not persisting the refresh token anywhere it will need to login again, and this can be fixed by storing it in a httponly cookie which is still vulnerable, - second the client part is completely missing, i know the purpose of this is to keep things simple, but then ppl needs to do real stuff. probably the refresh requests should be sent little before the accesstoken expires. - the array of refresh tokens or the db where you store them, means that we are not differing too much from usual session management which is opinable. Anyway, yours are very great tutorial, i am wondering what tools you use for registering videos

@debmallyabhattacharya4394 4 года назад

This lives up to its name. Truly simplified. 💙

@PyroManZII 4 года назад

Your channel is incredible and so informative! I clicked on the video to learn the best way to handle JWTs and in the first couple of minutes I am already learning about all these different things I didn't even know I didn't know. Do you happen to be an educator at all? It seems like you would be a great lecturer or teacher at a Uni or College.

@WebDevSimplified 4 года назад

Thank you so much! I am not a professional educator. I have been offered a job as a University professor before, but I love teaching online so I turned it down.

@spetsnaz_2 4 года назад

Man! every video of yours are most simplified on the web one could ever find.....Great work

@krunalchauhan5780 3 года назад

When I feel to buy any paid course then your video motivate me to save my money ❤️

@Bruno87198 Год назад

Exactily what I need! You just got a new subscriber. Simple, direct to the point, no use of database and other things, really direct to the point! Saves a lot of time. Thank you!

@techable7524 5 лет назад

Superb tutorial, video and sound! It's rare to find such quality. Subscribed and looking forward to more of your content.

@WebDevSimplified 5 лет назад

Thank you so much! I hope the rest of my videos are just as helpful.

@scigama71 3 года назад

i echo the sentiment that i have learned more with this video then reading books for hours.. Well done :)

@natyragashi982 2 года назад

Thank you man, you are one of the rarest who gives real solutions

@michelkazi3112 4 года назад

I'm using sails JS and their documentation is a hit or miss with a lot of things. They also have support for sessions instead of JWT. Your explanation and walkthrough were so nicely made that I was able to translate the logic of signing and verifying JWT into helpers for my project. Thank you!

@ozzyfromspace 3 года назад

This was a highly informative video and I’ve gotta say, I learned a ton watching you code this up! I do have a minor point of contention about the refresh token though.. you created the refresh token without an expiration date, so what’s preventing me from just using that on your 3000 server indefinitely? Hope someone can lend their perspective to this question :) Again Kyle, FABULOUS EXPLANATION! 🥳

@namminb6101 2 года назад

I think he made a mistake .. if someone gets the refresh token, they can use it to indefinitely generate new access tokens. The issue is not even that, the issue is that the reason we are using refresh token is so we can later invalidate it (allow user to logout and remove the refresh token from database), the issue then comes, if the user logs in again, the same exact refresh token (that the hacker already has) will be created again (since all inputs are the same), and the hacker can now continue generating access tokens, defeating the whole purpose of refresh tokens. I think either an expiry date or some other dynamic value should be added so that we create a new different token when a refresh token is invalidated (deleted from database).

@random2402 Месяц назад

Thank you bro for this amazing content. Just clean content, no bullshit. Thank you so much.

@farisfajar6982 3 года назад

Thanks youtube for recommend this channel. I just started to learn programming two weeks ago and find your channel. It is great content for me even i still did not really understand it most of the part so i need to learn a lot from the scratch.

@nithigd1014 3 года назад

Thank you for explaining complex concepts in very simple and straight forward way I watched many of your videos and I learnt a lot of things that no body could teach in 1 video but you are way of explaination is awesome, you are one of the best teacher in the universe, thank you so much :)

@zachwhite8054 4 года назад

Dude you might be my favorite web dev channel at this point. Massive Traversy fan and I also like Academind but damn this stuff is good

@johnnydriesen7575 4 года назад

Same here :)

@MariaSantos-em5jv 4 года назад

He explains things very well and at a nice pace.

@santhanamelumalai8025 3 года назад

Thanks for the video, I never saw tutorial video without skipping its part, but you broke that with the great way of story telling. Very helpful video.

@avivshvitzky2459 4 года назад

I still have some stuff that isn't clear to me, but you probably won't see my message, so i'l just say that you are an amazing teacher, you really have a skill in that area!

@WebDevSimplified 4 года назад

Thanks! I have another video on JWT that explains JWT in depth you may want to checkout.

@avivshvitzky2459 4 года назад

@@WebDevSimplified I think my biggest question is how the refresh token isnt prone to stealing as the access one

@raicubogdan8078 Год назад

i love how effortless and efficient you explain everything. and all the tools you use are really cool and easy to setup. thanks!

@solofaxum 4 года назад

Bro you are the best. That is all I can say. you simplify the complex. ...keep it up.

@SavijCoder Год назад

I know this is kind of older, but great presentation, very clear! I have a similar video for doing this in c# (also pretty old), but love how you explained it all here. Thanks!!

@mayank_upadhyay_19 4 года назад

Let me tell you that it was complicated, but after watching few times, I got the concept and implementation.

@buhlemwanza632 2 года назад

God Bless you man, this is great within 30 minutes JWT and auth isn't mystery anymore, keep it up, you're going to help a lot of people. God Bless you!

@haha-eg8fj 4 года назад

That Rest Client plugin is so useful! Works like a charm.

@winken2666 2 года назад

I am very grateful for this tutorial, thank you! My hobby project is one step closer to not being a hobby project.

@JeremiahJones-j1f 9 месяцев назад

Excellent video. Probably one of the best explanations I have seen. Also, fast - in a good way.

@MrVipulLal 7 месяцев назад

Your videos are always brilliant. A big 🙏

@denibegaj4564 4 года назад

Thanks, coming from the world of ASP.NET this was piece of cake. Dudes over there make it look like rocket launching, when it actually is a very simple mechanism.

@scu8a 3 года назад

Thank you for the quality tutorial. You're clear-spoken, and just the right speed for learning. At one point, I thought "This guys IQ must be over 140" - BTW, this is the first video of yours I watched. I found this video when I did a google search for "web token authentication". Again, very nice work.

@lautaro3365 4 года назад

Dude this was the best video I've seen about JWT and how easy you made it to implement.

@princebillygrahamkarmoker2122 3 года назад

Best tutorial on JWT token. You are straight forward and that's why I have already subscribed to your channel.

@dragmove 4 года назад

This video is perfect for me to understand a concept of JWT token and refresh token. I really appreciate it. Thanks Kyle. :)

@igors1208 4 года назад

The greatest video about jwt implementation on node i've found at internet! Thanks a lot!

@codeforlife9513 3 года назад

Kyle your video inspires me to learn more...and makes easy to understand all the aspects. Thank you so much.

@lucaslorenzo6249 Год назад

this is amazing, the way you explain all this concepts make it look easy

@kupaporusku 3 года назад

Nice, would be great to see it with implementation with frontend for ex. with react

@Tibo437 3 года назад

Thanks a lot from France for your video, this is so simple doing things with your explainations, please never stop ;)

@ShreeMamadevji Год назад

Very Good explanation Brother u are looking like Paul Walker of fast and furious

@dericbytes Год назад

I always pick up something new from your videos. Thanks

@chitrangsharma 3 года назад

Best programming ASMR channel 💓

@LithiumFireX 2 года назад

Hello Fireship, I love your 100 seconds videos.

@eduardotavares76 3 года назад

The best JWT video ever! You are amazing! Keep doing things like this.

@pranjalsinghkatiyar4972 Год назад

hey Kyle its good to see such a clear and refined video from backend side ... but could you please make a video explaining how client side uses the Refresh and Access JWT.

@daniloespinozapino4865 3 года назад

You did a really good job with this video dude. Simple and clean.

@sarahwang-h9x 7 месяцев назад

Thank you very much, Kyle. Your video helped me find a job. Thanks for sharing.

@AbhishekKumar-vl3cb 3 года назад

Have a good day you too...👍🎊 You just SIMPLIFIED my WEB DEV query in few minutes... ❤️🙏

@atsglobalservices6136 Год назад

God bless you dev. This tutorial was fantastic! I understand what you're saying. You don't dilute it with unnecessary jargon. Thank you very much.

@aynuayex Год назад

great content.since the video is outdated and also you are handling the refresh token manually(u are getting the refresh token through a post request not from the client directly) and does not have expire time,also we like to see how we can implement in react and also with the passport-jwt.we need updated new video on this since you are good at time.ya u deserve 1m subscribers.

@zeeshannagori007 4 года назад

Thanks Kyle for the information on this topic. Can you make a video on how to store the JWT on the client-side (best way to store JWT on the client-side) and how to send it back to the server whenever the request is made. Thanks again.

@joicyjoy9658 2 года назад

Kyle.....You are a gem for developers....

@alexanderzharkov6953 3 года назад

Thank you, Kyle, for this informative content. I filled many gaps watching your videos and following your advices

@JannisAdmek 3 года назад

You have such a fantastic way of teaching!

@materiku86 3 года назад

Amazing explanation, i hope you make video for implement this API with React.

@DoubleDYouTube 2 года назад

This video cleared up a lot of things regarding JWT. Thanks a lot!

@nabiisakhanov3522 4 года назад

Darn it Kyle, I get shocked every time I see you fixing mistakes in the code without a delay of thinking. I wonder if you make those typos on purpose to show people a few common ones, or you are just so good at coding you already know what's wrong as soon as you see an error :D

@WebDevSimplified 4 года назад

Sometimes I make mistakes on purpose but usually it is an honest mistake. Many times I edit out the pause that I take to fix the error though. I generally take a bit of time to find and fix my bugs.

@nabiisakhanov3522 4 года назад

@@WebDevSimplified oh, I see :) Whatever, your skills are very impressive still, and all the knowledge you share with people for free is just so precious for the webdev community. Personally I am going through my intership right now and it sometimes consumes a lot of time to find a reliable tutorial on some technologies. Your channel provides a big help here :) will consider becoming a patron next month

@WebDevSimplified 4 года назад

@@nabiisakhanov3522 Thank you so much!

@anamashraf8996 6 месяцев назад

How do we store the refresh token in client side securely?

@crazytk16 4 месяца назад

JUST THE TUTORIAL I NEED IT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

@zZMazeZz 2 года назад

Okay but what do you do with the access token in the response? How do you store it? Obviously your user is not going to be copying and pasting it.

@adrianharo6586 3 года назад

Thank you so much for this guide! It makes it easier to understand a concept when an example is simple and not convoluted. I did get lost around minute 14 because I wasn't sure about CLIENT REST and how to make Authorization an "array" I didn't realize your VS code had WORDWRAP on!! On VS code you can press ALT + z to turn on word wrap. I was sending GET requests with the token as a KEY with an empty value and kept running into "unathorized" The little details :(