- Most applications that deal with authenticated users,
they're routes that only should be accessible
if a user is logged in.
In our case we were careless,
and did not secure the my account route.
And while, in this particular case,
this just triggers an error and does not give us access
to restricted functionality, it is still something
that needs to be avoided by any means.
Imagine you bookmark this page
and your login session expired,
and this is what you get when you try to access it again.
In this video, we will add a little helper middleware
that sends the user to the login form
when they try to access a page without being logged in.
Plus, we will try to redirect the user
to the page they tried to access
in the first place if the login was successful.
So let's head into wishes for the code
and then we now install this helper.
So I terminate the node process by pressing Control C
in the console, and then I install in PIM install dash S,
and the module is called connect-ensure-login.
And this is actually also by the same author as Passport is,
so it integrates also very well with Passport.
All right then, let's head into server, routes, Index JX
because there we have, you see it in line 16,
is my account route and we want to secure it now.
So the first thing I'm going to do is I now bring
in this module by adding const,
and then I'm using curly brackets
because we are using destructuring here.
Ensure, logged in equals require, connect-ensure-login.
So this will now get us connect-ensure-login
dot ensure logged in.
So that's a middleware provided by this module.
And this middleware does nothing else
than looking into the request object
and the data structures created by Passport in there
to see if a user is actually logged in.
So to use it now, we scroll down to the my account route,
and there I will now simply add ensure logged in,
and there's an argument that just passing the route,
the user should be redirected too if they're not logged in.
And this is in our case auth login, so we sent them
to the login form, and that's it.
So with that, this route should already be secured.
I can only access it if I'm logged in.
I wanted to do one more thing.
So I head into auth, log interest, because as I said,
I also want to redirect the user back
to the page they wanted to access after the data logging.
And for that, this middleware also stores the initial URL
in the session and this property is called return to.
So now, inside login, we can simply scroll down
to line 36 where we do the redirect
and now say we want to redirect to request
that session dot return to, and if this is not set,
then we will default again to the index page.
Now let's start another application again,
and we get no error, that's a good sign,
And then let's head into the browser again.
So if I reload now this my account page,
and I'm not logged in,
then I should be redirected to the login form.
So let's try that.
And this works and next, I will now try
to log in lcorla, my secret too,
and let's click on login and this now should bring us
back to the my account page.
So let's see if this works, and you see, yes, we are
back at the my account page, and
that's a very good user experience
because you wanted to access the page,
but you had to provide your credentials first,
but now you're back on the page
where you wanted to go in the first place.
With that we can authenticate users using Passport,
and we can also secure routes with it.
One of the strengths of Passport is
that it comes with hundreds of strategies
for every authentication mechanism you can think of.
And starting with the next video, we will look
into what needs to be done
to secure REST APIs using Passport.