Node Auth Tutorial (JWT) #14 - Logging Users in (part 2)

[@heysalah]

I do not usually write comment on youtube But man You really have no idea how much you helped mr , When I ever I want to learn language or framework I always go to you, and actually not just me But also you helped a lot of my friends I mean Thank you is not enough But I love you shawn for real for everything you do. God bless you

[@NetNinja]

Thank you so much :)

[@AlejandzZ]

true!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[@robelasfaw243]

what a want to say, God bless you shawn

[@LaChRiZ2k]

For privacy reasons, you shouldn't response a "wrong email" message. Nobody should be able to check if someone else's e-mail address is registered on your site.

[@LucXX36]

Good point. Never thought about this.

[@alexanderjaye689]

This is very true - the OWASP recommendation is for something along the lines of "incorrect email and/or password" to not give any user details away. In Shaun's example here, a simple refactor of the errors object in the controller and the client side code would fix this.

[@andressalomon6703]

Totally agree! I created this quickly solution (just to follow with the tutorial): // handle errors for the login if (err.message === 'Incorrect email and/or password') { errors.email = err.message; errors.password = err.message; return errors; }; With that you fill in both fields and avoid changing too much code.

[@SparrowVivek]

then again, password reset feature will make this impossible. depends on developers i guess...

[@marcusudd1848]

But cant you just try to make new account using the email you want to check and in that case you would know if email exists?

[@ayushshaw3681]

Your tutorial is a blessing for me. I had been working on a project where user authentication was needed for a hackathon. I struggled, searched in the internet for docs, tutorials. Finally, my basics got cleared from your channel. Congratulations, you got a subscriber for entire life.

[@NetNinja]

That's really great to hear Ayush :) thanks for your support and for subscribing!

[@johnconnor9787]

couple of years ago I wrote in comments that the day will come and you will gain 1 000 000 subscribers... It is getting closer. Awesome job. You definitely deserve it

[@NetNinja]

Thank you and fingers crossed!!

[@akn9699]

All we asked for was " to listen to songs while turning off the screen in KZbin " BUT, Internet Gods had some other plans and Gave us Shaun ! Shaun is Love !

[@davidrowlands8548]

You need to use the browser version of KZbin on your phone, then you can do it.

[@AbhayKumar-rj3bk]

One of the best series we have

[@hemeshchadalavada3430]

Thanks for the amazing tutorial Ninja!

[@destinlee]

Still following along lol. I had to start over to make sure everything was sinking in ;)

[@ibrahims5457]

loving this series 😍

[@SanjayNG125]

Bro finally thank you.. in my travel and tourism project i was not setting the maxAge property but Im setting expiresIn for jwt token bcz of this the cookie type was session... I was struggling for 2 weeks to find the problem... Finally after setting maxAge on res.cookie it got expiry date... Tq 😅

[@rwandanelectricalguyz6293]

Hello first of all thank you, but in 15th video I used bcrypt.compare(password, this.password) and return error called 'data and hash argument are missing'; after struggling to much I have found that the reason is that: the 'this.password' is undefined! So why this is like that? as a substitute I used user.password to remove that error.

[@ahmedmarzouk5126]

Thank you for your efforts. great content!

[@simonmaquilon]

Ninja woooo, thanks Shaun!

[@silvenleaf8170]

Thanks A LOT Ninja Supreme!!!

[@bensonyeboah297]

Alright then Gang!!!!!!

[@amlansaikia652]

Login is showing wrong password although the compare function was working fine but after few times it is showing wrong password can anyone help me with this

[@loveyag6493]

How do you handle the mongo validation error in this approach. If user supplied empty email, invalid email or password field. Instead of showing proper error msg like invalid email or field is required it will shows the error msg from the throw in login function.

[@sucayono8848]

Thanks a lot Master!!!

[@kriptonVIP]

Thank you! 🙏

[@abdelrahmanhedia9483]

Why u r the best

[@HasanAli-vp6ci]

Great as always..pls also include email verification by sending verification link to the mail id

[@programmer4047]

The Course Has Completed, it's not possible now

[@HarelTussi]

Can you do a docker tutorial ?

[@NetNinja]

Hopefully at some point!

[@naywinhlaing7574]

Thank U,Ninja

[@projectbase7933]

Love you ninja

[@ayushgogna9732]

Hi I need help with whenever I log in everything is correct console also show me the user id but in terminal it gives me a error because of res.status(200).send({ user: user._idres.status(400).send({ errors }); line the error say Cannot set headers after they are sent to the client

[@ayushgogna9732]

the code is almost same as signup it works but login givingin me this error and it shuts the server and then I have to restart

[@martinp.617]

Salamat..,

[@ridl27]

ty.

[@abdulahad7318]

Everything is good but I didn’t like your technique of error handling because you hardcoded all messages and then compared them. What if I have multiple APIs in my project? All I need to do will be to write a separate error handler for them so there is code redundancy. Secondly, if I need to change my error messages in the future, I will also need to change my conditions inside error handlers as well. There must be a centralised error handler that handles all types of errors dynamically.

[@programmer4047]

Gimme a heart

[@anandkashyap6682]

But cookies are not enabled in incognito mode of browsers. That would break the whole app. I literally faced this issue. I don't know how to go around this.

[@omemester6985]

There are way to check if the user is using incognito mode and if they are then you can use local storage instead