This course will be retired on June 1, 2025.

Heads up! To view this whole video, sign in with your Courses account or enroll in your free 7-day trial. Sign In Enroll

Using Cookies and JWTs for Secure Authentication

Preview

Start a free Courses trial
to watch this video

Sign up for Treehouse

Securing Browser Information

3:21 with Alena Holligan

Security is ALWAY changing, so EVERYONE is continuously learning. This means you're in a great position because YOU know how to learn. As you continue to learn more, and security continues to evolve, you'll need to keep your code, and the packages you use, up to date through refactoring. In this course, we won't be changing the behavior of the project, instead, we'll be refactoring to increase security by using cookies and JSON Web Token.

If you want to review the session based user authentication, check out our Introduction to User Authentication course.

Related Discussions

Have questions about this video? Start a discussion with the community and Treehouse staff.

Sign up

    Related Discussions

    Have questions about this video? Start a discussion with the community and Treehouse staff.

    Sign up

    [MUSIC] 0:00
    Hello, Alena here to talk about authentication and security. 0:09
    Security is a huge topic, not only because of it's importance but 0:13
    also because there are so many different pieces. 0:18
    Before we start, I wanna let you in on a little secret. 0:21
    Security is always changing, so everyone is continuously learning. 0:25
    This means you're in a great position because you know how to learn. 0:31
    And if you'd like even more ideas for getting the most out of your learning, 0:35
    check out our How to Learn series, I'll link to it in the notes. 0:39
    Because security is always changing, 0:43
    one of the most important tools you'll be using is refactoring. 0:46
    Refactoring is the process of restructuring your code 0:50
    without changing the external behaviours. 0:54
    Developers use refactoring all the time, 0:57
    as technology is constantly changing, and security is no different. 1:01
    As you continue to learn more and security continues to evolve, 1:06
    you'll need to keep your code and the packages you use up-to-date. 1:10
    The project we'll be working on today is a book site, 1:15
    it already has a functional, session-based authentication and authorisation system. 1:19
    We won't be changing the behaviour of the project, instead, 1:25
    we'll be refactoring to increase security by using cookies and JSON web tokens. 1:29
    To get the most out of this course, 1:35
    you should already understand the basics of authentication. 1:37
    If you haven't learned the basics yet, or if you need a refresher, 1:41
    check the notes associated with this video. 1:45
    The technologies we'll be using in this course are cookies and tokens. 1:48
    We'll be using them together for our authentication system, but 1:53
    these technologies can be used independently of each other. 1:56
    Cookies are way for browser to store information, this can be 2:01
    anything from a language preference to how a visitor found out about the site. 2:05
    Cookies are used on any type of site, even ones that don't use authentication. 2:10
    Tokens are a stand-in, or representation for something else. 2:16
    In the real world, this may be a keycard that let's you access a building, 2:21
    or a wedding ring that represents your vows, both of these are a type of token. 2:26
    In the same way, a token in software represents something else, 2:32
    such as user authentication. 2:37
    A user would log into a system once, and then be presented with a token, 2:40
    which would then be used for all further requests. 2:45
    Tokens can be given a time limit, also shared between sites, and destroyed or 2:49
    reissued at any time without requiring a user to update their username or password. 2:56
    Tokens are stored on a user's device, but they do not need to be stored in a cookie. 3:03
    They may be used on a mobile device using local storage. 3:08
    Whether you use cookies and tokens together or 3:12
    separate, this course will show you how to work with each of those technologies 3:14
    to build the solution you need. 3:19

    You need to sign up for Treehouse in order to download course files.

    Sign up

      You need to sign up for Treehouse in order to set up Workspace

      Sign up