Add files using upload-large-folder tool

.gitattributes

@@ -119,3 +119,18 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 03[[:space:]]-[[:space:]]Advance[[:space:]]Java/021[[:space:]]What[[:space:]]is[[:space:]]Exception.mp4 filter=lfs diff=lfs merge=lfs -text
 03[[:space:]]-[[:space:]]Advance[[:space:]]Java/022[[:space:]]Exception[[:space:]]Handling[[:space:]]using[[:space:]]try[[:space:]]catch.mp4 filter=lfs diff=lfs merge=lfs -text
 03[[:space:]]-[[:space:]]Advance[[:space:]]Java/024[[:space:]]Exception[[:space:]]Hierarchy.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/026[[:space:]]Custom[[:space:]]Exception.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/023[[:space:]]Try[[:space:]]with[[:space:]]multiple[[:space:]]catch.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/025[[:space:]]Exception[[:space:]]throw[[:space:]]keyword.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/027[[:space:]]Ducking[[:space:]]Exception[[:space:]]using[[:space:]]throws.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/030[[:space:]]Threads.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/028[[:space:]]User[[:space:]]Input[[:space:]]using[[:space:]]BufferedReader[[:space:]]and[[:space:]]Scanner.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/029[[:space:]]Try[[:space:]]with[[:space:]]resources.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/033[[:space:]]Runnable[[:space:]]vs[[:space:]]Thread.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/032[[:space:]]Thread[[:space:]]Priority[[:space:]]and[[:space:]]Sleep.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/031[[:space:]]Multiple[[:space:]]Threads.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/035[[:space:]]Thread[[:space:]]states.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/036[[:space:]]Collection[[:space:]]API.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/034[[:space:]]Race[[:space:]]Condition.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/038[[:space:]]Set.mp4 filter=lfs diff=lfs merge=lfs -text
+03[[:space:]]-[[:space:]]Advance[[:space:]]Java/039[[:space:]]Map.mp4 filter=lfs diff=lfs merge=lfs -text

03 - Advance Java/023 Try with multiple catch.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1f988a6ed0ec641c94c27b4b6252b496c111eea476c39b18d38309631d4148dc
+size 167982266

03 - Advance Java/025 Exception throw keyword.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2fb6e52386d60ca774bb779ff2f7d6c822661b049ed490e2a1a908d74368a907
+size 85661874

03 - Advance Java/026 Custom Exception.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:360c76766d1d27936c3129d0805bb7d9602c74e98e8c6ac15a2eb6fb70d8a5c4
+size 57640187

03 - Advance Java/027 Ducking Exception using throws.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:b41a418266b17b878378aae5c107356f66f495f411402d3ab287887ab58a2908
+size 153426306

03 - Advance Java/028 User Input using BufferedReader and Scanner.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d9a89d35133823d2aa7e3f0718acab9b2fc4fb7d18014a1419101054682b9004
+size 192332565

03 - Advance Java/029 Try with resources.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:916f1b53ebfbf8196b3b1b4019ad984d67d366e9a002e7eff6e5ef8a99cdd6dc
+size 183484229

03 - Advance Java/030 Threads.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:547e1e1f623c078c26fff840f6b93263b67031219c1dbaa13b14d6bc321f8d53
+size 98408255

03 - Advance Java/031 Multiple Threads.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:146c9d273f172eb2a3e90bacbb4414b9d4afafe150522218caa158c8632e20fd
+size 184310750

03 - Advance Java/032 Thread Priority and Sleep.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:777c1df34bd13a9eda84126f9dceb0d025ef7ba0f73680b176d657f91ba4b243
+size 173252287

03 - Advance Java/033 Runnable vs Thread.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:024169cd5ed6385f02b7a12458bb3cc1472248e21c856b3a652e07f9e8be24d1
+size 136365684

03 - Advance Java/034 Race Condition.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:63673eee1ab38f427338e0eec3392ab330cd608bc1e07799c6912c0ce59b93d2
+size 204923140

03 - Advance Java/035 Thread states.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:61f6ded70f9bb617444ed59a714cfacd5626a8e7d3b225854e2933648a7f1715
+size 61505378

03 - Advance Java/036 Collection API.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:3b4ab013c00446a8e21d822a627d8fe674e1605481a990e48180f65bb593deae
+size 67323726

03 - Advance Java/038 Set.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:52618955195ec0401c5e99c35c450c78d31c94cc6246d0c5866743a36766c929
+size 115117359

03 - Advance Java/039 Map.mp4

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d030d7af0240655a75ca7176f71ac243a6c610503d0f7d158f1c94cb550d8495
+size 161660550

20 - Spring Security/014 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.14%20Disabling%20Csrf%20Token/spring-sec-demo

20 - Spring Security/015 without lambda_en.srt

@@ -0,0 +1,508 @@
+1
+00:00:00,000 --> 00:00:02,000
+(upbeat music)
+
+2
+00:00:02,000 --> 00:00:06,000
+-: So now let's convert this code into imperial style.
+
+3
+00:00:06,000 --> 00:00:08,000
+So I mean normal style.
+
+4
+00:00:08,000 --> 00:00:10,000
+So what I'm going to do is let's comment
+
+5
+00:00:10,000 --> 00:00:13,000
+this entire section, in fact till here, okay?
+
+6
+00:00:13,000 --> 00:00:15,000
+And now let's work one by one.
+
+7
+00:00:15,000 --> 00:00:19,000
+So first thing we have to address is http.csrf.
+
+8
+00:00:20,000 --> 00:00:24,000
+Now if you can see, if we talk about CSRF,
+
+9
+00:00:24,000 --> 00:00:25,000
+it takes a parameter of customizer
+
+10
+00:00:25,000 --> 00:00:30,000
+and of type CSRF, configure of type HttpSecurity.
+
+11
+00:00:30,000 --> 00:00:32,000
+So basically we have some types there.
+
+12
+00:00:32,000 --> 00:00:35,000
+So customizer takes a type of CsrfConfigurer,
+
+13
+00:00:35,000 --> 00:00:38,000
+which takes a type of HttpSecurity.
+
+14
+00:00:38,000 --> 00:00:40,000
+So what I'm going to do is we create an object of that
+
+15
+00:00:40,000 --> 00:00:42,000
+and let's pause it here.
+
+16
+00:00:42,000 --> 00:00:46,000
+So we have to get object of customizer of type
+
+17
+00:00:46,000 --> 00:00:51,000
+CsrfConfigurerr of type HttpSecurity
+
+18
+00:00:52,000 --> 00:00:57,000
+and then I will say this is customized CSRF equal to new.
+
+19
+00:00:58,000 --> 00:01:00,000
+And we get the object for the same thing.
+
+20
+00:01:00,000 --> 00:01:03,000
+And you can see we got the object.
+
+21
+00:01:03,000 --> 00:01:05,000
+But the thing is customize itself is interface, right?
+
+22
+00:01:05,000 --> 00:01:07,000
+So if you want to get the object of it,
+
+23
+00:01:07,000 --> 00:01:09,000
+we have to use anonymous in a class.
+
+24
+00:01:09,000 --> 00:01:10,000
+That's what I'm doing here.
+
+25
+00:01:10,000 --> 00:01:13,000
+And in this interface we only have one method.
+
+26
+00:01:13,000 --> 00:01:15,000
+If you can see the method name is customize.
+
+27
+00:01:15,000 --> 00:01:18,000
+So what I can do is I can just define that meta customize
+
+28
+00:01:18,000 --> 00:01:21,000
+and okay, that's the object we have created.
+
+29
+00:01:21,000 --> 00:01:25,000
+So the object name is, or the reference name is custCsrf
+
+30
+00:01:25,000 --> 00:01:29,000
+and we have to pass that custCsrf here.
+
+31
+00:01:29,000 --> 00:01:31,000
+Okay, so CSRF says you can configure me
+
+32
+00:01:31,000 --> 00:01:33,000
+by passing the object of this
+
+33
+00:01:33,000 --> 00:01:36,000
+and this the object type is customizer
+
+34
+00:01:36,000 --> 00:01:40,000
+with the type CsrfConfigurer HttpSecurity.
+
+35
+00:01:40,000 --> 00:01:42,000
+Now if you're thinking, do we have to remember this?
+
+36
+00:01:42,000 --> 00:01:44,000
+Not exactly anywhere when you are actually going to build,
+
+37
+00:01:44,000 --> 00:01:47,000
+we will be using the lambda expression,
+
+38
+00:01:47,000 --> 00:01:48,000
+not this type of code.
+
+39
+00:01:48,000 --> 00:01:49,000
+I'm just showing you this
+
+40
+00:01:49,000 --> 00:01:51,000
+so that you can understand what is happening.
+
+41
+00:01:51,000 --> 00:01:53,000
+So in this particular object creation,
+
+42
+00:01:53,000 --> 00:01:54,000
+we are using a method called customize
+
+43
+00:01:54,000 --> 00:01:56,000
+because that's the only method you have,
+
+44
+00:01:56,000 --> 00:01:59,000
+which takes a parameter of CsrfConfigurer,
+
+45
+00:01:59,000 --> 00:02:02,000
+which we are passing here of type HTTP.
+
+46
+00:02:02,000 --> 00:02:04,000
+And in this you can do the configuration.
+
+47
+00:02:04,000 --> 00:02:07,000
+So what I will do is instead of saying this big name,
+
+48
+00:02:07,000 --> 00:02:09,000
+I will say configure.
+
+49
+00:02:09,000 --> 00:02:12,000
+And then using that object of configure,
+
+50
+00:02:12,000 --> 00:02:13,000
+I can simply say disable.
+
+51
+00:02:13,000 --> 00:02:15,000
+Okay, so whatever you want to do
+
+52
+00:02:15,000 --> 00:02:16,000
+with this configure, you can do that.
+
+53
+00:02:16,000 --> 00:02:19,000
+You can set different properties or settings.
+
+54
+00:02:19,000 --> 00:02:22,000
+I'm just saying disable and the same thing I'm passing here.
+
+55
+00:02:22,000 --> 00:02:25,000
+So this one line of code is actually doing all this.
+
+56
+00:02:25,000 --> 00:02:27,000
+Again, if you are good with lambda, you don't even have
+
+57
+00:02:27,000 --> 00:02:29,000
+to watch this video, you can skip it.
+
+58
+00:02:29,000 --> 00:02:32,000
+But I'm just trying to make you understand how we got this
+
+59
+00:02:32,000 --> 00:02:34,000
+because when I saw this for the first time, I was like "hey,
+
+60
+00:02:34,000 --> 00:02:36,000
+what's happening behind the scene".
+
+61
+00:02:36,000 --> 00:02:37,000
+And this is what is happening.
+
+62
+00:02:37,000 --> 00:02:41,000
+Okay, next let's talk about the authorized HTTP request.
+
+63
+00:02:41,000 --> 00:02:42,000
+The same thing we can do there.
+
+64
+00:02:42,000 --> 00:02:46,000
+So we have to say HTTP dot authorize HTTP request,
+
+65
+00:02:46,000 --> 00:02:50,000
+and even this needs object of customizer.
+
+66
+00:02:50,000 --> 00:02:54,000
+So if you go there, you can see this particular method needs
+
+67
+00:02:54,000 --> 00:02:55,000
+object of customizer
+
+68
+00:02:55,000 --> 00:02:59,000
+but of type authorized HTTP request configure
+
+69
+00:02:59,000 --> 00:03:01,000
+of type HttpSecurity, big names, right?
+
+70
+00:03:01,000 --> 00:03:03,000
+And that's why we prefer to go with Lambda there.
+
+71
+00:03:03,000 --> 00:03:05,000
+So for this we have to create the object,
+
+72
+00:03:05,000 --> 00:03:10,000
+I will say customizer of type authorized HTTP request,
+
+73
+00:03:10,000 --> 00:03:13,000
+configure of type HttpSecurity.
+
+74
+00:03:13,000 --> 00:03:16,000
+And then again you have to say dot the actual object we have
+
+75
+00:03:16,000 --> 00:03:21,000
+create is authorized manager request manager registry.
+
+76
+00:03:21,000 --> 00:03:26,000
+And for this we'll create object of cost HTTP
+
+77
+00:03:26,000 --> 00:03:30,000
+equal to new, the same thing.
+
+78
+00:03:30,000 --> 00:03:32,000
+And you can see it's very lengthy name, right?
+
+79
+00:03:32,000 --> 00:03:34,000
+And no one want to remember this.
+
+80
+00:03:34,000 --> 00:03:36,000
+So you can see it's such a big name.
+
+81
+00:03:36,000 --> 00:03:38,000
+So you have to get object of customizer with this type
+
+82
+00:03:38,000 --> 00:03:41,000
+of authorized manager request match registry.
+
+83
+00:03:41,000 --> 00:03:43,000
+And once you have this object,
+
+84
+00:03:43,000 --> 00:03:45,000
+because that's the object we have to pass here,
+
+85
+00:03:45,000 --> 00:03:47,000
+which is custHttp.
+
+86
+00:03:47,000 --> 00:03:50,000
+And here in this bracket or in this definition,
+
+87
+00:03:50,000 --> 00:03:54,000
+I will say what was the method name registry.
+
+88
+00:03:54,000 --> 00:03:57,000
+So I'll say registry dot
+
+89
+00:03:57,000 --> 00:04:00,000
+for every request dot authenticated.
+
+90
+00:04:00,000 --> 00:04:03,000
+So basically I'm saying get authenticated
+
+91
+00:04:03,000 --> 00:04:05,000
+and that's how we can basically pass this.
+
+92
+00:04:05,000 --> 00:04:08,000
+Yeah, so this is basically your imperative style
+
+93
+00:04:08,000 --> 00:04:11,000
+of writing this, not a good idea, right?
+
+94
+00:04:11,000 --> 00:04:13,000
+But then now you know which classes are involved
+
+95
+00:04:13,000 --> 00:04:16,000
+behind the scene, okay?
+
+96
+00:04:16,000 --> 00:04:20,000
+And preferably we'll be using the lambda.
+
+97
+00:04:20,000 --> 00:04:23,000
+So this is only for showing you how things looks like,
+
+98
+00:04:23,000 --> 00:04:26,000
+but this is not the actual way of writing code here.
+
+99
+00:04:26,000 --> 00:04:28,000
+I would still prefer the lambda.
+
+100
+00:04:28,000 --> 00:04:30,000
+Let me just uncomment this.
+
+101
+00:04:30,000 --> 00:04:32,000
+For the session, also, we have the same thing.
+
+102
+00:04:32,000 --> 00:04:33,000
+You can explore session management.
+
+103
+00:04:33,000 --> 00:04:36,000
+We have to create object of customizer session management,
+
+104
+00:04:36,000 --> 00:04:39,000
+configure which of type HttpSecurity and this will work.
+
+105
+00:04:39,000 --> 00:04:42,000
+There's one more way of doing this since HTTP
+
+106
+00:04:42,000 --> 00:04:43,000
+follows a buildup pattern.
+
+107
+00:04:43,000 --> 00:04:44,000
+Instead of writing all this multiple times,
+
+108
+00:04:44,000 --> 00:04:48,000
+what you can do is you can HTTP dot CSRF
+
+109
+00:04:48,000 --> 00:04:50,000
+and then you can say DOT with the same thing.
+
+110
+00:04:50,000 --> 00:04:52,000
+So this is a buildup pattern so you don't have
+
+111
+00:04:52,000 --> 00:04:54,000
+to mention semicolon there at the end.
+
+112
+00:04:54,000 --> 00:04:57,000
+So we are confidentiality HTTP for CSRF first,
+
+113
+00:04:57,000 --> 00:05:01,000
+then authorized request and then dot HTTP
+
+114
+00:05:01,000 --> 00:05:03,000
+and then dot session management.
+
+115
+00:05:03,000 --> 00:05:06,000
+So you can see we are doing this in a line now
+
+116
+00:05:06,000 --> 00:05:07,000
+and that's what we can do.
+
+117
+00:05:07,000 --> 00:05:10,000
+In fact, if you want, you can see at the end dot build
+
+118
+00:05:10,000 --> 00:05:11,000
+and return that object itself
+
+119
+00:05:11,000 --> 00:05:12,000
+instead of doing all those things.
+
+120
+00:05:12,000 --> 00:05:14,000
+And that's why most of the time you will see this type
+
+121
+00:05:14,000 --> 00:05:16,000
+of configuration or somewhere you can also see this in a new
+
+122
+00:05:16,000 --> 00:05:20,000
+line if you want just to make things visible.
+
+123
+00:05:20,000 --> 00:05:23,000
+So yeah, that's how we can configure the CSRF disable
+
+124
+00:05:23,000 --> 00:05:24,000
+and other things here.
+
+125
+00:05:24,000 --> 00:05:27,000
+There are many, many configuration which we can do.
+
+126
+00:05:27,000 --> 00:05:29,000
+Maybe having multiple username password, not just one.
+
+127
+00:05:29,000 --> 00:05:32,000
+But how do you do that, let's say in the upcoming videos.
+

20 - Spring Security/017 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.17%20Working%20With%20Multiple%20Users/spring-sec-demo

20 - Spring Security/017 Working with Multiple Users_en.srt

@@ -0,0 +1,860 @@
+1
+00:00:00,000 --> 00:00:03,000
+(upbeat music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: So now let's write a code so
+
+3
+00:00:05,000 --> 00:00:06,000
+that we can have multiple users
+
+4
+00:00:06,000 --> 00:00:09,000
+and of course we want the users coming from database,
+
+5
+00:00:09,000 --> 00:00:11,000
+but then we'll go step by step so that it'll make sense.
+
+6
+00:00:11,000 --> 00:00:14,000
+The first thing we will do is let's hardcode the username
+
+7
+00:00:14,000 --> 00:00:17,000
+password values, not from database,
+
+8
+00:00:17,000 --> 00:00:19,000
+but let's hardcode them here in the code.
+
+9
+00:00:19,000 --> 00:00:21,000
+And I don't want to use this username password now.
+
+10
+00:00:21,000 --> 00:00:24,000
+The way you can achieve that, if you go back
+
+11
+00:00:24,000 --> 00:00:25,000
+to your security configuration,
+
+12
+00:00:25,000 --> 00:00:28,000
+and if you don't mention anything here by default,
+
+13
+00:00:28,000 --> 00:00:30,000
+the spring security uses something called
+
+14
+00:00:30,000 --> 00:00:32,000
+a UserDetailsService.
+
+15
+00:00:32,000 --> 00:00:35,000
+Now it uses this class to basically check
+
+16
+00:00:35,000 --> 00:00:38,000
+for your application properties
+
+17
+00:00:38,000 --> 00:00:39,000
+and see do you have username password there?
+
+18
+00:00:39,000 --> 00:00:42,000
+If yes, it will use it, but I don't want to use that.
+
+19
+00:00:42,000 --> 00:00:46,000
+I want to define my own UserDetailsService.
+
+20
+00:00:46,000 --> 00:00:50,000
+So what we will do is let's create a bean which will
+
+21
+00:00:50,000 --> 00:00:53,000
+return a UserDetailsService object.
+
+22
+00:00:53,000 --> 00:00:57,000
+And I can say this is UserDetailsService method, okay?
+
+23
+00:00:57,000 --> 00:00:59,000
+So basically I want to return the object
+
+24
+00:00:59,000 --> 00:01:02,000
+of user detail service and I want this to be bean.
+
+25
+00:01:02,000 --> 00:01:05,000
+Now what will happen is your spring security will look at
+
+26
+00:01:05,000 --> 00:01:08,000
+this particular object to get the data for the user.
+
+27
+00:01:08,000 --> 00:01:10,000
+So whatever data you're going to return on this,
+
+28
+00:01:10,000 --> 00:01:13,000
+will be your actual data where a spring security will check.
+
+29
+00:01:13,000 --> 00:01:15,000
+Okay, makes sense, but how do you return the data?
+
+30
+00:01:15,000 --> 00:01:17,000
+How do I specify the users?
+
+31
+00:01:17,000 --> 00:01:20,000
+And basically how can I return this user detail service?
+
+32
+00:01:20,000 --> 00:01:23,000
+Now if you go back to user detail service,
+
+33
+00:01:23,000 --> 00:01:24,000
+it's an interface, right?
+
+34
+00:01:24,000 --> 00:01:27,000
+And it has a method called load user by the username, okay?
+
+35
+00:01:27,000 --> 00:01:29,000
+So this is a method which is getting used behind the scene.
+
+36
+00:01:29,000 --> 00:01:34,000
+Our concern is this particular interface, it's an interface.
+
+37
+00:01:34,000 --> 00:01:36,000
+First of all, it has a method which returns the object
+
+38
+00:01:36,000 --> 00:01:37,000
+of user detail service.
+
+39
+00:01:37,000 --> 00:01:40,000
+So for us, the two important thing is this interface name
+
+40
+00:01:40,000 --> 00:01:43,000
+and it returns return type, which is user details.
+
+41
+00:01:43,000 --> 00:01:44,000
+If I go back here
+
+42
+00:01:44,000 --> 00:01:47,000
+and if I try to understand how do I create an object
+
+43
+00:01:47,000 --> 00:01:52,000
+for this, of course we don't want to get our own class now.
+
+44
+00:01:52,000 --> 00:01:54,000
+There is an inbuilt class which we can use.
+
+45
+00:01:54,000 --> 00:01:55,000
+So I can simply say return.
+
+46
+00:01:55,000 --> 00:01:57,000
+And the name of the inbuilt class is, if you can see,
+
+47
+00:01:57,000 --> 00:02:02,000
+we have something called InMemoryUserDetailsManager.
+
+48
+00:02:02,000 --> 00:02:05,000
+So we are going to use this because this particular object,
+
+49
+00:02:05,000 --> 00:02:09,000
+and if you see this implements, user details manager,
+
+50
+00:02:09,000 --> 00:02:11,000
+which extends user detail service.
+
+51
+00:02:11,000 --> 00:02:14,000
+So indirectly, this particular class,
+
+52
+00:02:14,000 --> 00:02:16,000
+which is InMemoryUserDetailsManager
+
+53
+00:02:16,000 --> 00:02:17,000
+implements the user detail service.
+
+54
+00:02:17,000 --> 00:02:19,000
+So our job is done because if you can return the object
+
+55
+00:02:19,000 --> 00:02:21,000
+of this indirectly hitting the object
+
+56
+00:02:21,000 --> 00:02:23,000
+of user detail service, okay,
+
+57
+00:02:23,000 --> 00:02:26,000
+but then we don't want to return the empty object, right?
+
+58
+00:02:26,000 --> 00:02:28,000
+We have to specify some values.
+
+59
+00:02:28,000 --> 00:02:31,000
+Let's try, and I want to really check if this works.
+
+60
+00:02:31,000 --> 00:02:35,000
+If I do this, it should not even accept the username
+
+61
+00:02:35,000 --> 00:02:36,000
+and password which is
+
+62
+00:02:36,000 --> 00:02:38,000
+specified in the application properties.
+
+63
+00:02:38,000 --> 00:02:41,000
+Let's try it out, so I hope this will, okay,
+
+64
+00:02:41,000 --> 00:02:43,000
+I will just manually restart sometime.
+
+65
+00:02:43,000 --> 00:02:45,000
+We don't trust the hard reload,
+
+66
+00:02:45,000 --> 00:02:46,000
+especially when you're experimenting.
+
+67
+00:02:46,000 --> 00:02:48,000
+Okay, reload, done, let me go back to the browser
+
+68
+00:02:48,000 --> 00:02:50,000
+and again, I will go for the incognito mode.
+
+69
+00:02:52,000 --> 00:02:55,000
+And here let's specify localized 8080.
+
+70
+00:02:55,000 --> 00:02:58,000
+It'll give you a prompt and now I will specify Telusko.
+
+71
+00:02:58,000 --> 00:03:01,000
+And 1, 2, 3, 4, enter, it's not working.
+
+72
+00:03:01,000 --> 00:03:02,000
+So basically the username, password,
+
+73
+00:03:02,000 --> 00:03:04,000
+which you have mentioned in the application properties
+
+74
+00:03:04,000 --> 00:03:06,000
+is not getting read.
+
+75
+00:03:06,000 --> 00:03:08,000
+Okay, so now let's specify the values here.
+
+76
+00:03:08,000 --> 00:03:10,000
+Now how do I specify the values?
+
+77
+00:03:10,000 --> 00:03:13,000
+See in this constructor of InMemoryUserDetailsManager,
+
+78
+00:03:13,000 --> 00:03:16,000
+if you click here, you can see it has multiple constructors.
+
+79
+00:03:16,000 --> 00:03:20,000
+One of the constructor is this, a collection of users.
+
+80
+00:03:20,000 --> 00:03:22,000
+If you don't want to pass a collection,
+
+81
+00:03:22,000 --> 00:03:25,000
+you can also pass a variable length arguments,
+
+82
+00:03:25,000 --> 00:03:26,000
+which is with Varargs,
+
+83
+00:03:26,000 --> 00:03:28,000
+and you can pass multiple users.
+
+84
+00:03:28,000 --> 00:03:29,000
+So I want to use this particular constructor
+
+85
+00:03:29,000 --> 00:03:33,000
+and I can pass any number of users I want.
+
+86
+00:03:33,000 --> 00:03:34,000
+And what object, what type of object
+
+87
+00:03:34,000 --> 00:03:37,000
+you wanna return, the user details object.
+
+88
+00:03:37,000 --> 00:03:39,000
+So that means here, even if you want
+
+89
+00:03:39,000 --> 00:03:41,000
+to create one particular user, you have
+
+90
+00:03:41,000 --> 00:03:42,000
+to create object of user details.
+
+91
+00:03:42,000 --> 00:03:44,000
+Here I would say user is equal to,
+
+92
+00:03:44,000 --> 00:03:46,000
+I should be importing this package.
+
+93
+00:03:46,000 --> 00:03:48,000
+I think it's already done.
+
+94
+00:03:48,000 --> 00:03:50,000
+And now how do I create the object of this?
+
+95
+00:03:50,000 --> 00:03:54,000
+If you go back to user details, oh, this is also interface.
+
+96
+00:03:54,000 --> 00:03:56,000
+I mean it's all coded for the interface, no problem.
+
+97
+00:03:56,000 --> 00:04:00,000
+We'll go back here and there's a class called user.
+
+98
+00:04:00,000 --> 00:04:03,000
+Okay, so the way we have user details, we also have user,
+
+99
+00:04:03,000 --> 00:04:07,000
+and this particular class, it has multiple methods.
+
+100
+00:04:07,000 --> 00:04:09,000
+It returns object of user builder,
+
+101
+00:04:09,000 --> 00:04:11,000
+if you can see, and user builder.
+
+102
+00:04:11,000 --> 00:04:14,000
+So it has a method called build, which returns user details.
+
+103
+00:04:14,000 --> 00:04:17,000
+And of course you don't have to remember every flow here,
+
+104
+00:04:17,000 --> 00:04:22,000
+just imagine the user has a method called user builder,
+
+105
+00:04:22,000 --> 00:04:24,000
+I mean a builder.build.
+
+106
+00:04:24,000 --> 00:04:26,000
+So basically user.builder.build will give
+
+107
+00:04:26,000 --> 00:04:27,000
+you the object of user details.
+
+108
+00:04:27,000 --> 00:04:28,000
+But then this is empty, right?
+
+109
+00:04:28,000 --> 00:04:30,000
+We don't want to go with empty one.
+
+110
+00:04:30,000 --> 00:04:31,000
+I want to specify some values to it.
+
+111
+00:04:31,000 --> 00:04:33,000
+So the first thing we have to mention
+
+112
+00:04:33,000 --> 00:04:34,000
+is the password encoder.
+
+113
+00:04:34,000 --> 00:04:36,000
+As I mentioned before, you don't want
+
+114
+00:04:36,000 --> 00:04:38,000
+to store your password in a plain text.
+
+115
+00:04:38,000 --> 00:04:40,000
+You want to store that in a encoded format.
+
+116
+00:04:40,000 --> 00:04:42,000
+So this, to start with, let's not do any encoding.
+
+117
+00:04:42,000 --> 00:04:45,000
+I will go for a default password encoder, this one.
+
+118
+00:04:45,000 --> 00:04:48,000
+So what I'm doing is I'm saying, "Hey, I'm going
+
+119
+00:04:48,000 --> 00:04:49,000
+for a default password encoder
+
+120
+00:04:49,000 --> 00:04:51,000
+and now I want to specify my username".
+
+121
+00:04:51,000 --> 00:04:54,000
+So you can say .username and you can mention the username.
+
+122
+00:04:54,000 --> 00:04:55,000
+So let's say I want to go for username
+
+123
+00:04:55,000 --> 00:04:57,000
+as navin and then you can say dot.
+
+124
+00:04:57,000 --> 00:04:58,000
+You can also set the password.
+
+125
+00:04:58,000 --> 00:05:01,000
+I want to set the password as n@123.
+
+126
+00:05:01,000 --> 00:05:03,000
+That's a password, and then if you want,
+
+127
+00:05:03,000 --> 00:05:05,000
+you can also specify the roles
+
+128
+00:05:05,000 --> 00:05:07,000
+and you can specify multiple roles here.
+
+129
+00:05:07,000 --> 00:05:11,000
+So if navin, I wanted to be admin as well as I want navin
+
+130
+00:05:11,000 --> 00:05:15,000
+to be user, I can specify both,
+
+131
+00:05:15,000 --> 00:05:16,000
+but at this point, let's say I want
+
+132
+00:05:16,000 --> 00:05:17,000
+to specify only one thing,
+
+133
+00:05:17,000 --> 00:05:18,000
+and that too makes sense if you have
+
+134
+00:05:18,000 --> 00:05:20,000
+in the capital, so it's a user.
+
+135
+00:05:20,000 --> 00:05:22,000
+And then at the end you can say build
+
+136
+00:05:22,000 --> 00:05:24,000
+because build returns object of user details.
+
+137
+00:05:24,000 --> 00:05:26,000
+And that's what we want, right?
+
+138
+00:05:26,000 --> 00:05:27,000
+Now if you want this to look good,
+
+139
+00:05:27,000 --> 00:05:29,000
+what you can also do is at this point you can say enter just
+
+140
+00:05:29,000 --> 00:05:32,000
+like a buildup pattern and you can say enter here.
+
+141
+00:05:32,000 --> 00:05:35,000
+So at least it'll make it much more readable
+
+142
+00:05:35,000 --> 00:05:37,000
+compared to the earlier one.
+
+143
+00:05:37,000 --> 00:05:40,000
+And if you try to read now what it says is,
+
+144
+00:05:40,000 --> 00:05:44,000
+we got a user in which we have a chain of methods.
+
+145
+00:05:44,000 --> 00:05:45,000
+We are going for a default password encoder.
+
+146
+00:05:45,000 --> 00:05:47,000
+Then we are going for the username, password,
+
+147
+00:05:47,000 --> 00:05:49,000
+roles and build.
+
+148
+00:05:49,000 --> 00:05:51,000
+And this particular object, the user object,
+
+149
+00:05:51,000 --> 00:05:52,000
+I can simply pass here
+
+150
+00:05:52,000 --> 00:05:56,000
+because that's how we can pass the object of user details
+
+151
+00:05:56,000 --> 00:05:58,000
+to the constructor here.
+
+152
+00:05:58,000 --> 00:06:00,000
+And you can pass multiple objects, not just one user.
+
+153
+00:06:00,000 --> 00:06:02,000
+You can create multiple user details, object,
+
+154
+00:06:02,000 --> 00:06:04,000
+and you can pass it here for multiple users.
+
+155
+00:06:04,000 --> 00:06:06,000
+And now let's talk about this.
+
+156
+00:06:06,000 --> 00:06:08,000
+What is this with default password encoder?
+
+157
+00:06:08,000 --> 00:06:11,000
+Now basically this is a method which says I don't want to go
+
+158
+00:06:11,000 --> 00:06:13,000
+for any encoder at this point.
+
+159
+00:06:13,000 --> 00:06:15,000
+Later on we'll move to different encoders,
+
+160
+00:06:15,000 --> 00:06:16,000
+but at this point we're not using it.
+
+161
+00:06:16,000 --> 00:06:18,000
+But again, not recommended.
+
+162
+00:06:18,000 --> 00:06:20,000
+And that's why it says it is deprecated.
+
+163
+00:06:20,000 --> 00:06:22,000
+We should not be using this in the production
+
+164
+00:06:22,000 --> 00:06:23,000
+or I mean it,
+
+165
+00:06:23,000 --> 00:06:25,000
+you should be only using it while learning purpose.
+
+166
+00:06:25,000 --> 00:06:27,000
+Never use it for even for experiments.
+
+167
+00:06:27,000 --> 00:06:29,000
+Sometime yes, you want
+
+168
+00:06:29,000 --> 00:06:30,000
+to check if everything is flowing well
+
+169
+00:06:30,000 --> 00:06:33,000
+and you have a pathway in database.
+
+170
+00:06:33,000 --> 00:06:35,000
+And if you want to verify, that's when you can do it,
+
+171
+00:06:35,000 --> 00:06:37,000
+but not in a normal scenario.
+
+172
+00:06:37,000 --> 00:06:39,000
+Okay, so we got a user and I can do the same thing.
+
+173
+00:06:39,000 --> 00:06:43,000
+Let's say I want to have one more user here, which is this.
+
+174
+00:06:43,000 --> 00:06:46,000
+And I can say this is user, maybe I want
+
+175
+00:06:46,000 --> 00:06:48,000
+to create an admin now with default encoder.
+
+176
+00:06:48,000 --> 00:06:50,000
+And I will say, let's execute in,
+
+177
+00:06:50,000 --> 00:06:52,000
+or maybe I can have admin itself.
+
+178
+00:06:52,000 --> 00:06:56,000
+And the password I want to go for is admin@789.
+
+179
+00:06:58,000 --> 00:07:00,000
+And the goal I want to give here is admin, okay?
+
+180
+00:07:00,000 --> 00:07:02,000
+That's how we can create another user here.
+
+181
+00:07:02,000 --> 00:07:05,000
+And here we can pass admin as well.
+
+182
+00:07:05,000 --> 00:07:06,000
+So depending upon how many objects you have,
+
+183
+00:07:06,000 --> 00:07:08,000
+we can pass those objects here.
+
+184
+00:07:08,000 --> 00:07:11,000
+Now I hope this will work, let me relaunch again.
+
+185
+00:07:11,000 --> 00:07:16,000
+I don't trust the hot reloads, so it's launching.
+
+186
+00:07:16,000 --> 00:07:18,000
+I will go back to my browser, refresh.
+
+187
+00:07:18,000 --> 00:07:20,000
+Okay, so we're not started yet.
+
+188
+00:07:20,000 --> 00:07:22,000
+So I was started and now here I will say,
+
+189
+00:07:22,000 --> 00:07:24,000
+let me try Telusko once again.
+
+190
+00:07:24,000 --> 00:07:26,000
+And I would say 1234, not working.
+
+191
+00:07:26,000 --> 00:07:28,000
+Let me say Navin and the password,
+
+192
+00:07:28,000 --> 00:07:30,000
+I will just enter a random password, which is incorrect.
+
+193
+00:07:30,000 --> 00:07:32,000
+Sign in not working.
+
+194
+00:07:32,000 --> 00:07:37,000
+Again, I will send Navin and the password is n@123,
+
+195
+00:07:37,000 --> 00:07:39,000
+sign in, worked, okay?
+
+196
+00:07:39,000 --> 00:07:42,000
+So whatever details
+
+197
+00:07:42,000 --> 00:07:43,000
+or whatever username password you mentioned,
+
+198
+00:07:43,000 --> 00:07:45,000
+you can use that here.
+
+199
+00:07:45,000 --> 00:07:47,000
+What if I wanna try with admin, let's try.
+
+200
+00:07:47,000 --> 00:07:49,000
+So that's the new incognito mode.
+
+201
+00:07:49,000 --> 00:07:53,000
+I would say admin, password is admin@789.
+
+202
+00:07:53,000 --> 00:07:55,000
+Enter, it worked.
+
+203
+00:07:55,000 --> 00:07:56,000
+So basically whatever username password
+
+204
+00:07:56,000 --> 00:07:58,000
+you mentioned here, it will work.
+
+205
+00:07:58,000 --> 00:07:59,000
+But again, this is not coming from database.
+
+206
+00:07:59,000 --> 00:08:01,000
+Let's see, how do you make it work
+
+207
+00:08:01,000 --> 00:08:03,000
+with the database in the upcoming videos.
+
+208
+00:08:03,000 --> 00:08:05,000
+But at this point, what we are doing is we are not going
+
+209
+00:08:05,000 --> 00:08:07,000
+for a default implementation of user detail service.
+
+210
+00:08:07,000 --> 00:08:09,000
+We are defining it by ourself.
+
+211
+00:08:09,000 --> 00:08:11,000
+And the way you can do that is by returning the object
+
+212
+00:08:11,000 --> 00:08:14,000
+of InMemoryUserDetailsManager.
+
+213
+00:08:14,000 --> 00:08:16,000
+And we are returning these two objects.
+
+214
+00:08:16,000 --> 00:08:18,000
+So yeah, that's it from this video.
+
+215
+00:08:18,000 --> 00:08:19,000
+See you in the upcoming videos.
+

20 - Spring Security/018 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.18%20Creating%20User%20Table%20And%20Db%20Properties/spring-sec-demo

20 - Spring Security/019 AuthenticationProvider_en.srt

@@ -0,0 +1,536 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: And now let's try to create that provider.
+
+3
+00:00:05,000 --> 00:00:09,000
+So basically behind the scene, you are the Spring config.
+
+4
+00:00:09,000 --> 00:00:11,000
+Whenever you implement Spring security,
+
+5
+00:00:11,000 --> 00:00:14,000
+it'll provide you a authentication provider.
+
+6
+00:00:14,000 --> 00:00:16,000
+But I don't want to use default one
+
+7
+00:00:16,000 --> 00:00:17,000
+because I want to create my own now,
+
+8
+00:00:17,000 --> 00:00:18,000
+which we will link with database.
+
+9
+00:00:18,000 --> 00:00:21,000
+So what I will do is I will create a bean
+
+10
+00:00:21,000 --> 00:00:26,000
+which returns an authentication provider, okay?
+
+11
+00:00:26,000 --> 00:00:28,000
+And of course you can have multiple providers
+
+12
+00:00:28,000 --> 00:00:29,000
+in the same application.
+
+13
+00:00:29,000 --> 00:00:31,000
+At this point, I'm just working with DAO.
+
+14
+00:00:31,000 --> 00:00:33,000
+So I will say public authentication provider
+
+15
+00:00:33,000 --> 00:00:35,000
+and I will have the method name as auth provider.
+
+16
+00:00:35,000 --> 00:00:38,000
+Now what we to do is first of all, we have to make this
+
+17
+00:00:38,000 --> 00:00:40,000
+as a bean and then we have to return the object
+
+18
+00:00:40,000 --> 00:00:42,000
+of authentication provider.
+
+19
+00:00:42,000 --> 00:00:44,000
+Now if you jump to authentication provider,
+
+20
+00:00:44,000 --> 00:00:45,000
+you can see it's the interface.
+
+21
+00:00:45,000 --> 00:00:46,000
+Basically we have to search
+
+22
+00:00:46,000 --> 00:00:49,000
+for the class which implements this interface, right?
+
+23
+00:00:49,000 --> 00:00:52,000
+And it has only one method visit, which is authenticate.
+
+24
+00:00:52,000 --> 00:00:55,000
+So basically whenever you pass a username password,
+
+25
+00:00:55,000 --> 00:00:58,000
+that becomes a part of authentication object.
+
+26
+00:00:58,000 --> 00:00:59,000
+You can see we have an object here
+
+27
+00:00:59,000 --> 00:01:02,000
+and then this using this object, it will authenticate it.
+
+28
+00:01:02,000 --> 00:01:03,000
+If the user is there,
+
+29
+00:01:03,000 --> 00:01:05,000
+of course you will get the object of authentication.
+
+30
+00:01:05,000 --> 00:01:08,000
+If the user is not there, if the authentication fails,
+
+31
+00:01:08,000 --> 00:01:09,000
+it'll throw an exception.
+
+32
+00:01:09,000 --> 00:01:11,000
+Okay? So that's what we want.
+
+33
+00:01:11,000 --> 00:01:12,000
+But then I don't have a class, right?
+
+34
+00:01:12,000 --> 00:01:14,000
+So do we have a class in build?
+
+35
+00:01:14,000 --> 00:01:16,000
+Now for different type of authentication,
+
+36
+00:01:16,000 --> 00:01:18,000
+we have different type of authentication provider.
+
+37
+00:01:18,000 --> 00:01:20,000
+Now since we are working with database,
+
+38
+00:01:20,000 --> 00:01:23,000
+we have something called a DAO authentication provider.
+
+39
+00:01:23,000 --> 00:01:25,000
+So if you jump here,
+
+40
+00:01:25,000 --> 00:01:26,000
+you can see this is a class which
+
+41
+00:01:26,000 --> 00:01:27,000
+is DAO authentication provider.
+
+42
+00:01:27,000 --> 00:01:30,000
+It's a class that means we can create an object
+
+43
+00:01:30,000 --> 00:01:31,000
+and this extends the
+
+44
+00:01:31,000 --> 00:01:34,000
+abstract user details authentication provider.
+
+45
+00:01:34,000 --> 00:01:37,000
+If I click on this, it implements authentication provider
+
+46
+00:01:37,000 --> 00:01:39,000
+so that it'll do our job, right?
+
+47
+00:01:39,000 --> 00:01:41,000
+So that means if I create object
+
+48
+00:01:41,000 --> 00:01:44,000
+of DAO authentication provider, I would say provider
+
+49
+00:01:44,000 --> 00:01:47,000
+equal to new authentication provider.
+
+50
+00:01:47,000 --> 00:01:50,000
+And then if I return the same object provider,
+
+51
+00:01:50,000 --> 00:01:51,000
+our job is done, right?
+
+52
+00:01:51,000 --> 00:01:53,000
+See, we wanted the object of authentication provider
+
+53
+00:01:53,000 --> 00:01:56,000
+and we got the object of authentication provider
+
+54
+00:01:56,000 --> 00:01:58,000
+and we are returning it, right?
+
+55
+00:01:58,000 --> 00:02:00,000
+Now, this basically connects with the database
+
+56
+00:02:00,000 --> 00:02:02,000
+and it'll return the object.
+
+57
+00:02:02,000 --> 00:02:04,000
+And that's the thing we want, right?
+
+58
+00:02:04,000 --> 00:02:05,000
+Now will this work?
+
+59
+00:02:05,000 --> 00:02:07,000
+See, we have done the job,
+
+60
+00:02:07,000 --> 00:02:09,000
+we have created the authentication provider,
+
+61
+00:02:09,000 --> 00:02:11,000
+but then this will not work
+
+62
+00:02:11,000 --> 00:02:14,000
+because this particular class object has no idea
+
+63
+00:02:14,000 --> 00:02:16,000
+which DBMS you're working with.
+
+64
+00:02:16,000 --> 00:02:18,000
+How do I represent a user class?
+
+65
+00:02:18,000 --> 00:02:20,000
+And what is the user table name?
+
+66
+00:02:20,000 --> 00:02:22,000
+So we have to mention all those things.
+
+67
+00:02:22,000 --> 00:02:24,000
+And the way you can do that is we have
+
+68
+00:02:24,000 --> 00:02:26,000
+to create a user detail service.
+
+69
+00:02:26,000 --> 00:02:27,000
+We do have it here,
+
+70
+00:02:27,000 --> 00:02:29,000
+but then this user detail service
+
+71
+00:02:29,000 --> 00:02:31,000
+works with the static values.
+
+72
+00:02:31,000 --> 00:02:33,000
+We don't want to work with static values.
+
+73
+00:02:33,000 --> 00:02:35,000
+So what I will do is I will just commend this part.
+
+74
+00:02:35,000 --> 00:02:37,000
+I don't want to work with static values now.
+
+75
+00:02:37,000 --> 00:02:40,000
+I want to have a dynamic database connectivity.
+
+76
+00:02:40,000 --> 00:02:44,000
+And to achieve this, to create a user digital service,
+
+77
+00:02:44,000 --> 00:02:45,000
+first of all, why do we need it?
+
+78
+00:02:45,000 --> 00:02:47,000
+So if you say provider here,
+
+79
+00:02:47,000 --> 00:02:49,000
+and when you say dot,
+
+80
+00:02:49,000 --> 00:02:53,000
+there's a option of set user details service,
+
+81
+00:02:53,000 --> 00:02:55,000
+because authentication provider will say, I will check,
+
+82
+00:02:55,000 --> 00:02:57,000
+but tell me how do I connect with the user table?
+
+83
+00:02:57,000 --> 00:02:59,000
+What's the process I have follow?
+
+84
+00:02:59,000 --> 00:03:02,000
+And that is taken care by the user detailed service.
+
+85
+00:03:02,000 --> 00:03:04,000
+And that's what we have done before that as well.
+
+86
+00:03:04,000 --> 00:03:06,000
+But then that was study values.
+
+87
+00:03:06,000 --> 00:03:08,000
+I want to use this service for the database connectivity.
+
+88
+00:03:08,000 --> 00:03:10,000
+And for that we have to create a separate class
+
+89
+00:03:10,000 --> 00:03:12,000
+to achieve that.
+
+90
+00:03:12,000 --> 00:03:15,000
+And that class object need to specify here.
+
+91
+00:03:15,000 --> 00:03:18,000
+Now this particular method needs object
+
+92
+00:03:18,000 --> 00:03:19,000
+of user detail service.
+
+93
+00:03:19,000 --> 00:03:21,000
+So what I can do is
+
+94
+00:03:21,000 --> 00:03:24,000
+before we create a class, I want to create a bean here.
+
+95
+00:03:24,000 --> 00:03:28,000
+So I would say private user details service,
+
+96
+00:03:28,000 --> 00:03:29,000
+and I would say user detailed service.
+
+97
+00:03:29,000 --> 00:03:32,000
+And I want this to be auto wired.
+
+98
+00:03:32,000 --> 00:03:34,000
+So basically I'm asking, Hey, Spring Framework,
+
+99
+00:03:34,000 --> 00:03:36,000
+I want the object of user digital service.
+
+100
+00:03:36,000 --> 00:03:37,000
+I don't know where, from where you get it,
+
+101
+00:03:37,000 --> 00:03:39,000
+give me this object so that I can pass it here.
+
+102
+00:03:39,000 --> 00:03:42,000
+Okay? But then even Spring has no idea how do we do that?
+
+103
+00:03:42,000 --> 00:03:45,000
+Okay, so we have to configure this.
+
+104
+00:03:45,000 --> 00:03:48,000
+We have to basically implement the user digital service
+
+105
+00:03:48,000 --> 00:03:49,000
+because that's an interface.
+
+106
+00:03:49,000 --> 00:03:50,000
+And that's why I mentioned, right?
+
+107
+00:03:50,000 --> 00:03:52,000
+We have multiple classes to implement.
+
+108
+00:03:52,000 --> 00:03:55,000
+So basically the provider here, okay, where? Where's that?
+
+109
+00:03:55,000 --> 00:03:57,000
+Let me just close all the extra files.
+
+110
+00:03:57,000 --> 00:03:59,000
+So yeah, so the provider here is dependent
+
+111
+00:03:59,000 --> 00:04:01,000
+on the user data service.
+
+112
+00:04:01,000 --> 00:04:04,000
+If we can pass the object of this, our job is done,
+
+113
+00:04:04,000 --> 00:04:06,000
+but then this is the interface, right?
+
+114
+00:04:06,000 --> 00:04:07,000
+We have to create a class which will implement
+
+115
+00:04:07,000 --> 00:04:09,000
+this interface where we have
+
+116
+00:04:09,000 --> 00:04:11,000
+the implementation and then this will work.
+
+117
+00:04:11,000 --> 00:04:12,000
+So that's the first thing you have to do.
+
+118
+00:04:12,000 --> 00:04:14,000
+The second one is we have
+
+119
+00:04:14,000 --> 00:04:16,000
+to also specify the password encoder.
+
+120
+00:04:16,000 --> 00:04:19,000
+Again, I don't want to use any password encoder here.
+
+121
+00:04:19,000 --> 00:04:21,000
+So I will say set password encoder.
+
+122
+00:04:21,000 --> 00:04:23,000
+If you don't want to have any password encoder,
+
+123
+00:04:23,000 --> 00:04:24,000
+you can simply opt
+
+124
+00:04:24,000 --> 00:04:28,000
+for NoOpPasswordEncoder.getinstance.
+
+125
+00:04:28,000 --> 00:04:31,000
+So we are getting the object of no op password encoder.
+
+126
+00:04:31,000 --> 00:04:33,000
+So basically I don't want to use any password encoder.
+
+127
+00:04:33,000 --> 00:04:36,000
+In future, if you want to use any password encoder,
+
+128
+00:04:36,000 --> 00:04:37,000
+just replace this and your job is done.
+
+129
+00:04:37,000 --> 00:04:39,000
+And we are saying set password encoder. That's it.
+
+130
+00:04:39,000 --> 00:04:41,000
+These are the two things you have to mention.
+
+131
+00:04:41,000 --> 00:04:42,000
+But again, this will not work
+
+132
+00:04:42,000 --> 00:04:44,000
+because we don't have the implementation
+
+133
+00:04:44,000 --> 00:04:45,000
+for the use detailed service.
+
+134
+00:04:45,000 --> 00:04:48,000
+Okay, how do I do that? Let's see in the next video.
+

20 - Spring Security/019 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.19%20Authenticationprovider/spring-sec-demo

20 - Spring Security/020 Creating a UserDetailsService_en.srt

@@ -0,0 +1,384 @@
+1
+00:00:00,000 --> 00:00:03,000
+(bright music)
+
+2
+00:00:03,000 --> 00:00:07,000
+-: Okay, now it's time to implement the user details service.
+
+3
+00:00:07,000 --> 00:00:10,000
+So what I will do is I will create a new class.
+
+4
+00:00:10,000 --> 00:00:12,000
+And in fact, you know, before we do that,
+
+5
+00:00:12,000 --> 00:00:15,000
+I just want to put everything in a particular package
+
+6
+00:00:15,000 --> 00:00:17,000
+that should make sense.
+
+7
+00:00:17,000 --> 00:00:20,000
+So I will just create a new package
+
+8
+00:00:20,000 --> 00:00:22,000
+and I will say these are controllers.
+
+9
+00:00:22,000 --> 00:00:24,000
+So I will have all my controllers here.
+
+10
+00:00:24,000 --> 00:00:27,000
+So basically I want to move the hello controller,
+
+11
+00:00:27,000 --> 00:00:30,000
+string controller, and this particular controller.
+
+12
+00:00:30,000 --> 00:00:32,000
+Yes, refactor.
+
+13
+00:00:32,000 --> 00:00:36,000
+I want to have a model class somewhere else.
+
+14
+00:00:36,000 --> 00:00:38,000
+I will say model.
+
+15
+00:00:38,000 --> 00:00:40,000
+And the student basically is a model class.
+
+16
+00:00:40,000 --> 00:00:42,000
+I will move that to, oh, I've created a model class,
+
+17
+00:00:42,000 --> 00:00:43,000
+not the package.
+
+18
+00:00:48,000 --> 00:00:51,000
+So model package, the student will go there.
+
+19
+00:00:51,000 --> 00:00:54,000
+And then I want to have a service layer as well.
+
+20
+00:00:54,000 --> 00:00:56,000
+Maybe in your project you want
+
+21
+00:00:56,000 --> 00:00:57,000
+to have multiple service classes.
+
+22
+00:00:57,000 --> 00:00:59,000
+I will say this is service layer.
+
+23
+00:00:59,000 --> 00:01:00,000
+And in this service layer,
+
+24
+00:01:00,000 --> 00:01:03,000
+I want to create a class for the user details service
+
+25
+00:01:03,000 --> 00:01:05,000
+because that's a service, right?
+
+26
+00:01:05,000 --> 00:01:07,000
+So I'll just right click here and say New Java class
+
+27
+00:01:07,000 --> 00:01:11,000
+and I will name this as my user details service,
+
+28
+00:01:11,000 --> 00:01:14,000
+because this is going to implement user details service.
+
+29
+00:01:14,000 --> 00:01:15,000
+I will say create.
+
+30
+00:01:15,000 --> 00:01:20,000
+And this is going to implement the user details service.
+
+31
+00:01:20,000 --> 00:01:22,000
+Okay, so we've got a class now
+
+32
+00:01:22,000 --> 00:01:24,000
+and this class object,
+
+33
+00:01:24,000 --> 00:01:27,000
+basically I have to pass in here, okay?
+
+34
+00:01:27,000 --> 00:01:31,000
+And the way you can do that is by making this as a service.
+
+35
+00:01:31,000 --> 00:01:32,000
+Of course you can also say component,
+
+36
+00:01:32,000 --> 00:01:33,000
+but this is service layer.
+
+37
+00:01:33,000 --> 00:01:35,000
+So service make much more sense.
+
+38
+00:01:35,000 --> 00:01:37,000
+Now what we are doing is when you say auto wire,
+
+39
+00:01:37,000 --> 00:01:40,000
+this particular class object will be injected,
+
+40
+00:01:40,000 --> 00:01:42,000
+but then you are getting an error here.
+
+41
+00:01:42,000 --> 00:01:43,000
+We are getting the error
+
+42
+00:01:43,000 --> 00:01:46,000
+because if you go to user detail, user detailed service,
+
+43
+00:01:46,000 --> 00:01:49,000
+it has a method called load user by username.
+
+44
+00:01:49,000 --> 00:01:53,000
+That means we have to implement that particular method.
+
+45
+00:01:53,000 --> 00:01:55,000
+So what I will do here is I will go back here
+
+46
+00:01:55,000 --> 00:01:57,000
+and let's implement it.
+
+47
+00:01:57,000 --> 00:01:59,000
+I will simply ask my IDE say,
+
+48
+00:01:59,000 --> 00:02:02,000
+implement the methods and it will just implement the method.
+
+49
+00:02:02,000 --> 00:02:04,000
+Of course the logic you have to define,
+
+50
+00:02:04,000 --> 00:02:06,000
+but it'll give you a structure.
+
+51
+00:02:06,000 --> 00:02:08,000
+So the structure is this particular class
+
+52
+00:02:08,000 --> 00:02:11,000
+or this particular method, which is load user by username,
+
+53
+00:02:11,000 --> 00:02:14,000
+takes a string username as a parameter,
+
+54
+00:02:14,000 --> 00:02:16,000
+and then we can perform the operation there.
+
+55
+00:02:16,000 --> 00:02:18,000
+And after performing the operation,
+
+56
+00:02:18,000 --> 00:02:22,000
+we have to return the object of user details.
+
+57
+00:02:22,000 --> 00:02:24,000
+Now, this is some, this is something we have to do now.
+
+58
+00:02:24,000 --> 00:02:26,000
+Oh, okay, the code is not getting completed, right?
+
+59
+00:02:26,000 --> 00:02:28,000
+But yeah, we'll be there, don't worry.
+
+60
+00:02:28,000 --> 00:02:31,000
+So since we are going step by step, let's focus.
+
+61
+00:02:31,000 --> 00:02:33,000
+So we have lower the user by username.
+
+62
+00:02:33,000 --> 00:02:34,000
+So that's the method we have to implement.
+
+63
+00:02:34,000 --> 00:02:36,000
+Now if you observe,
+
+64
+00:02:36,000 --> 00:02:38,000
+basically we are saying load user by username.
+
+65
+00:02:38,000 --> 00:02:40,000
+That means when you get a username,
+
+66
+00:02:40,000 --> 00:02:45,000
+we have to basically hit the database to get this detail.
+
+67
+00:02:45,000 --> 00:02:48,000
+Now question guys, how will you hit the database
+
+68
+00:02:48,000 --> 00:02:49,000
+and how will you return this?
+
+69
+00:02:49,000 --> 00:02:51,000
+Now to hit the database,
+
+70
+00:02:51,000 --> 00:02:53,000
+we need to have a repo layer, right?
+
+71
+00:02:53,000 --> 00:02:55,000
+Database connectivity is done by the repo layer,
+
+72
+00:02:55,000 --> 00:02:56,000
+not the service class.
+
+73
+00:02:56,000 --> 00:03:00,000
+And for that, we have to create object of user repo.
+
+74
+00:03:00,000 --> 00:03:02,000
+Now, user repo is not a class.
+
+75
+00:03:02,000 --> 00:03:04,000
+This is something we have to create.
+
+76
+00:03:04,000 --> 00:03:05,000
+It can be a class or the interface.
+
+77
+00:03:05,000 --> 00:03:07,000
+If you're using normal JDPC, we have to get a class.
+
+78
+00:03:07,000 --> 00:03:10,000
+If you're using JPA, we can do that
+
+79
+00:03:10,000 --> 00:03:11,000
+with the help of interface.
+
+80
+00:03:11,000 --> 00:03:13,000
+So I'm saying user repo, repo,
+
+81
+00:03:13,000 --> 00:03:15,000
+and I want this to be auto wired.
+
+82
+00:03:15,000 --> 00:03:20,000
+I will say auto wired and I will make this as private.
+
+83
+00:03:20,000 --> 00:03:22,000
+Now, basically using this particular class
+
+84
+00:03:22,000 --> 00:03:25,000
+or the interface, we have to get the database connectivity
+
+85
+00:03:25,000 --> 00:03:27,000
+and implement the code here.
+
+86
+00:03:27,000 --> 00:03:28,000
+Now the code is actually very simple.
+
+87
+00:03:28,000 --> 00:03:31,000
+The code is you use this particular repository
+
+88
+00:03:31,000 --> 00:03:34,000
+and fire the query to the data database.
+
+89
+00:03:34,000 --> 00:03:38,000
+If you get a user in return, that's great, you got a login.
+
+90
+00:03:38,000 --> 00:03:41,000
+But what if you don't have a user that time you can say,
+
+91
+00:03:41,000 --> 00:03:44,000
+user not found, or user 404, some error, right?
+
+92
+00:03:44,000 --> 00:03:46,000
+And then at the end you have
+
+93
+00:03:46,000 --> 00:03:47,000
+to return the object of user details.
+
+94
+00:03:47,000 --> 00:03:50,000
+So how do we do that? And to do that, we have to first
+
+95
+00:03:50,000 --> 00:03:53,000
+of all create this interface called user repo.
+
+96
+00:03:53,000 --> 00:03:55,000
+How do we create that? Let's say in the next video.
+

20 - Spring Security/020 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.20%20Creating%20A%20Userdetailsservice/spring-sec-demo

20 - Spring Security/021 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.21%20User%20Repository/spring-sec-demo

20 - Spring Security/021 User Repository_en.srt

@@ -0,0 +1,560 @@
+1
+00:00:00,000 --> 00:00:02,000
+(upbeat music)
+
+2
+00:00:02,000 --> 00:00:06,000
+-: Okay, so now it's time to create this interface
+
+3
+00:00:06,000 --> 00:00:07,000
+or a class called UserRepo.
+
+4
+00:00:07,000 --> 00:00:10,000
+Now, since we are using JPA, we are going
+
+5
+00:00:10,000 --> 00:00:12,000
+to create a interface and that's what we are seeing here.
+
+6
+00:00:12,000 --> 00:00:15,000
+So you can see it says, "Hey, we don't have this UserRepo".
+
+7
+00:00:15,000 --> 00:00:18,000
+I will say, "okay, create a interface
+
+8
+00:00:18,000 --> 00:00:20,000
+called UserRepo in the package".
+
+9
+00:00:20,000 --> 00:00:23,000
+I'll say Dao layer and click on, okay?
+
+10
+00:00:23,000 --> 00:00:25,000
+And you can see we've got a Dao layer
+
+11
+00:00:25,000 --> 00:00:26,000
+in which you have as UserRepo.
+
+12
+00:00:26,000 --> 00:00:30,000
+And this particular UserRepo is going to extend
+
+13
+00:00:30,000 --> 00:00:33,000
+the JPA repository.
+
+14
+00:00:33,000 --> 00:00:34,000
+Now since we are connecting with database,
+
+15
+00:00:34,000 --> 00:00:36,000
+we have to do that.
+
+16
+00:00:36,000 --> 00:00:39,000
+And then in this JPA repository we have to pass two things.
+
+17
+00:00:39,000 --> 00:00:41,000
+The first one is the table name,
+
+18
+00:00:41,000 --> 00:00:43,000
+which we'll connect with the class.
+
+19
+00:00:43,000 --> 00:00:44,000
+Basically we have to mention the class name,
+
+20
+00:00:44,000 --> 00:00:47,000
+which we'll connect with the table, the ORM entity.
+
+21
+00:00:47,000 --> 00:00:49,000
+And then we have to mention the primary key.
+
+22
+00:00:49,000 --> 00:00:51,000
+The primary key is of type integer, okay?
+
+23
+00:00:51,000 --> 00:00:54,000
+So basically we need to get this interface called UserRepo,
+
+24
+00:00:54,000 --> 00:00:56,000
+which extends our JPA repository.
+
+25
+00:00:56,000 --> 00:01:00,000
+But the problem is we don't have this class yet.
+
+26
+00:01:00,000 --> 00:01:04,000
+So what I will do is I will create this class called user
+
+27
+00:01:04,000 --> 00:01:06,000
+and I will do that in my own package.
+
+28
+00:01:06,000 --> 00:01:09,000
+So I will go back to model and that's what, right?
+
+29
+00:01:09,000 --> 00:01:12,000
+So you have to remember which file goes where.
+
+30
+00:01:12,000 --> 00:01:15,000
+So in the model we'll create a user
+
+31
+00:01:15,000 --> 00:01:17,000
+which will represent a table.
+
+32
+00:01:17,000 --> 00:01:21,000
+And this particular class will have the same number
+
+33
+00:01:21,000 --> 00:01:23,000
+of properties as you have in the table, right?
+
+34
+00:01:23,000 --> 00:01:26,000
+So I will say private int id.
+
+35
+00:01:26,000 --> 00:01:31,000
+Then I want a private string username
+
+36
+00:01:31,000 --> 00:01:35,000
+and a private string password.
+
+37
+00:01:35,000 --> 00:01:37,000
+Now this is the same thing we have in the table.
+
+38
+00:01:37,000 --> 00:01:38,000
+So if you go back to your table,
+
+39
+00:01:38,000 --> 00:01:40,000
+you can see we have the same properties, Id,
+
+40
+00:01:40,000 --> 00:01:42,000
+username and password.
+
+41
+00:01:42,000 --> 00:01:46,000
+Now the problem here is I don't want to use dataset,
+
+42
+00:01:46,000 --> 00:01:47,000
+I just want to use Lombok.
+
+43
+00:01:47,000 --> 00:01:51,000
+And I think we don't have a Lombok here.
+
+44
+00:01:51,000 --> 00:01:55,000
+So we'll go back to my pom.xml and Lombok,
+
+45
+00:01:55,000 --> 00:01:56,000
+okay Lombok is there.
+
+46
+00:01:56,000 --> 00:01:58,000
+So what I can do is I can simply use Lombok here
+
+47
+00:01:58,000 --> 00:02:02,000
+for the users and I want to close all the extra files.
+
+48
+00:02:02,000 --> 00:02:04,000
+So I don't want to use controller anymore.
+
+49
+00:02:04,000 --> 00:02:05,000
+Showing control are done,
+
+50
+00:02:05,000 --> 00:02:08,000
+student we are not going to use now.
+
+51
+00:02:08,000 --> 00:02:09,000
+Xml, we are not going to touch.
+
+52
+00:02:09,000 --> 00:02:11,000
+So these are the files we have
+
+53
+00:02:11,000 --> 00:02:14,000
+and okay, let's go back to the user.
+
+54
+00:02:14,000 --> 00:02:17,000
+And I want to have a data, okay?
+
+55
+00:02:17,000 --> 00:02:21,000
+Now since this is also a entity for the OLM,
+
+56
+00:02:21,000 --> 00:02:23,000
+so I will say this is entity
+
+57
+00:02:23,000 --> 00:02:26,000
+and then this will also have a primary key,
+
+58
+00:02:26,000 --> 00:02:27,000
+which is Id here.
+
+59
+00:02:27,000 --> 00:02:29,000
+And we have talked about all those things in data JP, right?
+
+60
+00:02:29,000 --> 00:02:32,000
+So let's not waste our time more on explanation,
+
+61
+00:02:32,000 --> 00:02:33,000
+but we have done this.
+
+62
+00:02:33,000 --> 00:02:36,000
+So we got entity, we got Id and okay,
+
+63
+00:02:36,000 --> 00:02:37,000
+there's one little problem.
+
+64
+00:02:37,000 --> 00:02:39,000
+The class name I'm using as user,
+
+65
+00:02:39,000 --> 00:02:42,000
+but the table name is users, okay?
+
+66
+00:02:42,000 --> 00:02:44,000
+We have a different table name.
+
+67
+00:02:44,000 --> 00:02:46,000
+So if you want to have a different table name,
+
+68
+00:02:46,000 --> 00:02:49,000
+we have to basically mention at table,
+
+69
+00:02:49,000 --> 00:02:51,000
+and you can mention the table name here.
+
+70
+00:02:51,000 --> 00:02:54,000
+So you can say name is equal to users.
+
+71
+00:02:54,000 --> 00:02:56,000
+Since we have a different table name,
+
+72
+00:02:56,000 --> 00:02:57,000
+that's the only reason here.
+
+73
+00:02:57,000 --> 00:02:59,000
+And that's it, you got user, user table created.
+
+74
+00:02:59,000 --> 00:03:01,000
+I can go back here
+
+75
+00:03:01,000 --> 00:03:03,000
+and import the package from our, remember that we have
+
+76
+00:03:03,000 --> 00:03:07,000
+to import from our own package, not from the spring.
+
+77
+00:03:07,000 --> 00:03:10,000
+And that's it, we got this UserRepo, okay?
+
+78
+00:03:10,000 --> 00:03:13,000
+Now there's one little thing we have to do here
+
+79
+00:03:13,000 --> 00:03:16,000
+because if you say load user by username,
+
+80
+00:03:16,000 --> 00:03:17,000
+we are passing a username, right?
+
+81
+00:03:17,000 --> 00:03:21,000
+And that means the repo has to search by username.
+
+82
+00:03:21,000 --> 00:03:23,000
+And to achieve that, we have to use a method
+
+83
+00:03:23,000 --> 00:03:26,000
+which will return me a user.
+
+84
+00:03:26,000 --> 00:03:28,000
+I will say find by username.
+
+85
+00:03:28,000 --> 00:03:31,000
+And in the bracket I will say string username.
+
+86
+00:03:31,000 --> 00:03:34,000
+Technically we have one mistake in our code, not the code,
+
+87
+00:03:34,000 --> 00:03:35,000
+but the design of this database.
+
+88
+00:03:35,000 --> 00:03:38,000
+Don't you think the username should be unique?
+
+89
+00:03:38,000 --> 00:03:40,000
+Or maybe you can make your username as primary key,
+
+90
+00:03:40,000 --> 00:03:42,000
+not the Id, because we want to have it unique.
+
+91
+00:03:42,000 --> 00:03:45,000
+So when you create it, make sure that you have
+
+92
+00:03:45,000 --> 00:03:47,000
+not null or unique
+
+93
+00:03:47,000 --> 00:03:50,000
+or maybe just make your username as your primary key.
+
+94
+00:03:50,000 --> 00:03:51,000
+That will make much more sense.
+
+95
+00:03:51,000 --> 00:03:54,000
+But even this works, I will just make sure
+
+96
+00:03:54,000 --> 00:03:56,000
+that I have a use unique username there.
+
+97
+00:03:56,000 --> 00:03:59,000
+Okay, so we got this repo ready
+
+98
+00:03:59,000 --> 00:04:03,000
+and now I can use this repo in this particular method.
+
+99
+00:04:03,000 --> 00:04:05,000
+How do I do that, so one thing is for sure,
+
+100
+00:04:05,000 --> 00:04:08,000
+when we use this repo, so if I say repo dot,
+
+101
+00:04:08,000 --> 00:04:11,000
+you can see we have a method called find by username
+
+102
+00:04:11,000 --> 00:04:13,000
+in which you can pass the same username.
+
+103
+00:04:13,000 --> 00:04:18,000
+So now this repo is responsible to connect with database,
+
+104
+00:04:18,000 --> 00:04:20,000
+get the data, and we are getting this data here.
+
+105
+00:04:20,000 --> 00:04:23,000
+So when you say repo dot find user by username,
+
+106
+00:04:23,000 --> 00:04:24,000
+it'll fire the query behind the scene.
+
+107
+00:04:24,000 --> 00:04:27,000
+And what you will get in return is the type
+
+108
+00:04:27,000 --> 00:04:28,000
+which you have mentioned here.
+
+109
+00:04:28,000 --> 00:04:30,000
+The type is user.
+
+110
+00:04:30,000 --> 00:04:34,000
+So you can simply go back here and say user user equal to.
+
+111
+00:04:34,000 --> 00:04:36,000
+So what we are getting in return is user,
+
+112
+00:04:36,000 --> 00:04:39,000
+and this user is from my own package, not spring.
+
+113
+00:04:39,000 --> 00:04:41,000
+Now, once you got the user, you have
+
+114
+00:04:41,000 --> 00:04:44,000
+to check if the user is null or not, right?
+
+115
+00:04:44,000 --> 00:04:47,000
+So we'll check, if the user is null.
+
+116
+00:04:47,000 --> 00:04:50,000
+In that case, we have to throw an exception.
+
+117
+00:04:50,000 --> 00:04:52,000
+Remember, you can see we have this particular method,
+
+118
+00:04:52,000 --> 00:04:56,000
+load user by username, throws a user not found exception.
+
+119
+00:04:56,000 --> 00:04:58,000
+So I can simply throw the same exception.
+
+120
+00:04:58,000 --> 00:05:01,000
+So I can say, in fact, I want to print on console as well.
+
+121
+00:05:01,000 --> 00:05:06,000
+First of all, I will say user 404, user not found.
+
+122
+00:05:06,000 --> 00:05:07,000
+And I will throw the same exception.
+
+123
+00:05:07,000 --> 00:05:12,000
+So I will say, throw new user, not found exception.
+
+124
+00:05:12,000 --> 00:05:15,000
+I can print a message as well.
+
+125
+00:05:15,000 --> 00:05:19,000
+Maybe the same message if you want, yeah, that's it.
+
+126
+00:05:19,000 --> 00:05:21,000
+So if the user is not found,
+
+127
+00:05:21,000 --> 00:05:23,000
+we can simply throw the exception.
+
+128
+00:05:23,000 --> 00:05:25,000
+But what if you found the user?
+
+129
+00:05:25,000 --> 00:05:29,000
+In that case, we have to return the user,
+
+130
+00:05:29,000 --> 00:05:31,000
+but you can't simply return a user.
+
+131
+00:05:31,000 --> 00:05:35,000
+You can see what you are expecting here is not just a user,
+
+132
+00:05:35,000 --> 00:05:37,000
+but a user details.
+
+133
+00:05:37,000 --> 00:05:40,000
+Okay, so we need to make this work.
+
+134
+00:05:40,000 --> 00:05:41,000
+So instead of return a user,
+
+135
+00:05:41,000 --> 00:05:43,000
+we have to return a user, user details.
+
+136
+00:05:43,000 --> 00:05:48,000
+But if you click on user details, it's an interface.
+
+137
+00:05:48,000 --> 00:05:49,000
+So now you know what's the next video?
+
+138
+00:05:49,000 --> 00:05:53,000
+The next video is about let's implement this user details
+
+139
+00:05:53,000 --> 00:05:55,000
+so that we can return it from here.
+
+140
+00:05:55,000 --> 00:05:57,000
+How to do that, let's see in the next video.
+

20 - Spring Security/022 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.22%20Userdetails%20And%20Userprincipal/spring-sec-demo

20 - Spring Security/022 UserDetails and UserPrincipal_en.srt

@@ -0,0 +1,732 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:07,000
+-: So now let's try to return the UserDetails object.
+
+3
+00:00:07,000 --> 00:00:10,000
+But again, we have interface, we have to be a class.
+
+4
+00:00:10,000 --> 00:00:13,000
+So the next step is create a UserDetails.
+
+5
+00:00:13,000 --> 00:00:16,000
+I will do that in the model package, not in dao.
+
+6
+00:00:16,000 --> 00:00:19,000
+I'll just go back here and say new class.
+
+7
+00:00:19,000 --> 00:00:24,000
+And this class nickname as UserDetailsImplementation
+
+8
+00:00:25,000 --> 00:00:26,000
+because we are implementing
+
+9
+00:00:26,000 --> 00:00:28,000
+this particular interface.
+
+10
+00:00:28,000 --> 00:00:33,000
+Or a better name for that is UserPrincipal.
+
+11
+00:00:33,000 --> 00:00:35,000
+Because in the terms of Spring Security,
+
+12
+00:00:35,000 --> 00:00:38,000
+when you are representing a current user,
+
+13
+00:00:38,000 --> 00:00:39,000
+we call them as principals.
+
+14
+00:00:39,000 --> 00:00:41,000
+So the current user, which we are authenticating,
+
+15
+00:00:41,000 --> 00:00:42,000
+is a principal, okay?
+
+16
+00:00:42,000 --> 00:00:45,000
+So UserPrincipal makes much more sense,
+
+17
+00:00:45,000 --> 00:00:47,000
+but again, you can name your class
+
+18
+00:00:47,000 --> 00:00:50,000
+as UserDetailsImplementation, your choice.
+
+19
+00:00:50,000 --> 00:00:55,000
+So this UserPrincipal implements the UserDetails, okay?
+
+20
+00:00:56,000 --> 00:00:58,000
+And now let's provide the methods.
+
+21
+00:00:58,000 --> 00:00:59,000
+We have multiple methods there,
+
+22
+00:00:59,000 --> 00:01:00,000
+so we have to implement them.
+
+23
+00:01:00,000 --> 00:01:02,000
+So what I will do is I will just go back here
+
+24
+00:01:02,000 --> 00:01:04,000
+and say implement methods.
+
+25
+00:01:04,000 --> 00:01:06,000
+And you can see we have multiple methods
+
+26
+00:01:06,000 --> 00:01:07,000
+and we don't have a choice.
+
+27
+00:01:07,000 --> 00:01:08,000
+We have to implement everything.
+
+28
+00:01:08,000 --> 00:01:10,000
+And I will click on OK.
+
+29
+00:01:10,000 --> 00:01:12,000
+Now all these methods provides different purpose.
+
+30
+00:01:12,000 --> 00:01:16,000
+Example, let's go from bottom to up. So first is it enabled?
+
+31
+00:01:16,000 --> 00:01:18,000
+We have to check if the account is enabled.
+
+32
+00:01:18,000 --> 00:01:20,000
+Then is the credentials not expired?
+
+33
+00:01:20,000 --> 00:01:22,000
+We have to check for the expiry.
+
+34
+00:01:22,000 --> 00:01:24,000
+Is the account logged? We have to check for that.
+
+35
+00:01:24,000 --> 00:01:27,000
+Is the account expired? We have to check for that.
+
+36
+00:01:27,000 --> 00:01:28,000
+And then we have to check
+
+37
+00:01:28,000 --> 00:01:30,000
+for the username, password,
+
+38
+00:01:30,000 --> 00:01:32,000
+and then the authority.
+
+39
+00:01:32,000 --> 00:01:35,000
+Also, right, because every user will have different access,
+
+40
+00:01:35,000 --> 00:01:39,000
+admin access, user access, trainer access.
+
+41
+00:01:39,000 --> 00:01:41,000
+So whatever access you can mention, you can do that here.
+
+42
+00:01:41,000 --> 00:01:42,000
+Now since in this particular example,
+
+43
+00:01:42,000 --> 00:01:44,000
+we are not focusing on all these things.
+
+44
+00:01:44,000 --> 00:01:47,000
+So we'll keep it true. We don't want to check them.
+
+45
+00:01:47,000 --> 00:01:50,000
+So we are not even checking if it is expired.
+
+46
+00:01:50,000 --> 00:01:52,000
+Is it enabled, is it logged?
+
+47
+00:01:52,000 --> 00:01:53,000
+We are saying everything is good,
+
+48
+00:01:53,000 --> 00:01:55,000
+no need to worry about the expiry and logging.
+
+49
+00:01:55,000 --> 00:01:57,000
+So we'll keep it as true.
+
+50
+00:01:57,000 --> 00:01:58,000
+We have to work with this three methods.
+
+51
+00:01:58,000 --> 00:02:02,000
+First one is getAuthorities, getPassword and getUsername.
+
+52
+00:02:02,000 --> 00:02:05,000
+Now (indistinct) where you will get it.
+
+53
+00:02:05,000 --> 00:02:08,000
+See if you go back to your UserDetails service,
+
+54
+00:02:08,000 --> 00:02:10,000
+we do have this in user object
+
+55
+00:02:10,000 --> 00:02:12,000
+because user object will have everything.
+
+56
+00:02:12,000 --> 00:02:14,000
+The username, the password, also authority.
+
+57
+00:02:14,000 --> 00:02:17,000
+I'm not doing that so I will just hardcode that.
+
+58
+00:02:17,000 --> 00:02:19,000
+But if in your table we can have one more column
+
+59
+00:02:19,000 --> 00:02:23,000
+for the authority and you can return that in the user class.
+
+60
+00:02:23,000 --> 00:02:24,000
+So the user class will have username, password,
+
+61
+00:02:24,000 --> 00:02:26,000
+and authority as well.
+
+62
+00:02:26,000 --> 00:02:27,000
+At this point, I don't wanna do that.
+
+63
+00:02:27,000 --> 00:02:30,000
+Okay, so we'll keep it, we'll hardcode this part,
+
+64
+00:02:30,000 --> 00:02:32,000
+but the question arise, how will I get the access
+
+65
+00:02:32,000 --> 00:02:36,000
+of this particular user object in here?
+
+66
+00:02:36,000 --> 00:02:38,000
+So what we can do is here,
+
+67
+00:02:38,000 --> 00:02:39,000
+when you are returning the object,
+
+68
+00:02:39,000 --> 00:02:41,000
+so instead of saying return User,
+
+69
+00:02:41,000 --> 00:02:45,000
+I can say return new UserPrincipal
+
+70
+00:02:45,000 --> 00:02:48,000
+because UserPrincipal implements the UserDetails, right?
+
+71
+00:02:48,000 --> 00:02:50,000
+So you can see there's no error now,
+
+72
+00:02:50,000 --> 00:02:52,000
+but what if you can actually pass this object here?
+
+73
+00:02:52,000 --> 00:02:54,000
+Now when you can pass this object here,
+
+74
+00:02:54,000 --> 00:02:58,000
+we can accept the object here and then we can work with it.
+
+75
+00:02:58,000 --> 00:03:00,000
+And to accept it, we need a constructor.
+
+76
+00:03:00,000 --> 00:03:03,000
+So I'll say public UserPrincipal,
+
+77
+00:03:03,000 --> 00:03:05,000
+which will accept the user objects.
+
+78
+00:03:05,000 --> 00:03:10,000
+I will say User user. And I will, okay.
+
+79
+00:03:10,000 --> 00:03:12,000
+So I will also create object here
+
+80
+00:03:12,000 --> 00:03:15,000
+so that I can get the instance access
+
+81
+00:03:15,000 --> 00:03:19,000
+and this.user is equal to user.
+
+82
+00:03:19,000 --> 00:03:22,000
+So whatever object I'm receiving from the UserDetails,
+
+83
+00:03:22,000 --> 00:03:23,000
+I will just assign this to here
+
+84
+00:03:23,000 --> 00:03:25,000
+so that I can access in other methods.
+
+85
+00:03:25,000 --> 00:03:28,000
+Okay, now how do I get the username? It's very simple.
+
+86
+00:03:28,000 --> 00:03:31,000
+You can simply say user.getUsername.
+
+87
+00:03:31,000 --> 00:03:32,000
+How will I get the password?
+
+88
+00:03:32,000 --> 00:03:35,000
+It's very simple. You can say user.getPassword.
+
+89
+00:03:35,000 --> 00:03:36,000
+How will you get the authority?
+
+90
+00:03:36,000 --> 00:03:38,000
+We don't have it in the user.
+
+91
+00:03:38,000 --> 00:03:40,000
+So I can just return a hardcoded value,
+
+92
+00:03:40,000 --> 00:03:43,000
+and you can see it is expecting you
+
+93
+00:03:43,000 --> 00:03:45,000
+to return a Collection.
+
+94
+00:03:45,000 --> 00:03:48,000
+So I will say Collections.
+
+95
+00:03:48,000 --> 00:03:49,000
+And then we just want
+
+96
+00:03:49,000 --> 00:03:51,000
+to return one particular object, right?
+
+97
+00:03:51,000 --> 00:03:52,000
+So I can say singleton.
+
+98
+00:03:52,000 --> 00:03:53,000
+Now I can specify the type here.
+
+99
+00:03:53,000 --> 00:03:55,000
+Now you can see this singleton,
+
+100
+00:03:55,000 --> 00:03:59,000
+which returns one object, is expecting you to have an object
+
+101
+00:03:59,000 --> 00:04:03,000
+of GrantedAuthority because that's the type we are using.
+
+102
+00:04:03,000 --> 00:04:06,000
+So collection of type GrantedAuthority.
+
+103
+00:04:06,000 --> 00:04:07,000
+So we have to get object here.
+
+104
+00:04:07,000 --> 00:04:10,000
+So it's a new, so the class which implements
+
+105
+00:04:10,000 --> 00:04:12,000
+because if you say GrantedAuthority, it's interface.
+
+106
+00:04:12,000 --> 00:04:16,000
+So the class which implements this is simple,
+
+107
+00:04:18,000 --> 00:04:21,000
+GrantedAuthority, and this you can pass the authority.
+
+108
+00:04:21,000 --> 00:04:22,000
+So let's say, I will say this is user.
+
+109
+00:04:22,000 --> 00:04:25,000
+So by default, every user which I have in database
+
+110
+00:04:25,000 --> 00:04:27,000
+will be by default user.
+
+111
+00:04:27,000 --> 00:04:28,000
+But again, it will make much more sense when
+
+112
+00:04:28,000 --> 00:04:31,000
+to have extra column of authorities there.
+
+113
+00:04:31,000 --> 00:04:34,000
+And that's it, this is your UserPrincipal class,
+
+114
+00:04:34,000 --> 00:04:38,000
+which I'm using it here, and looks like everything is there.
+
+115
+00:04:38,000 --> 00:04:40,000
+But the question is, will it work?
+
+116
+00:04:40,000 --> 00:04:43,000
+Now finally, we are going to run this project,
+
+117
+00:04:43,000 --> 00:04:46,000
+after four to five videos, we are running this project
+
+118
+00:04:46,000 --> 00:04:48,000
+and we can get the error, and we'll solve it
+
+119
+00:04:48,000 --> 00:04:49,000
+if you get the error.
+
+120
+00:04:49,000 --> 00:04:50,000
+Let's relaunch it.
+
+121
+00:04:50,000 --> 00:04:53,000
+Okay, there's still some problem here.
+
+122
+00:04:53,000 --> 00:04:55,000
+Maybe hard reloading is not working properly.
+
+123
+00:04:55,000 --> 00:04:57,000
+I will just restart the application manually. Let's restart.
+
+124
+00:04:57,000 --> 00:05:00,000
+Okay, so at this point there's no problem.
+
+125
+00:05:00,000 --> 00:05:03,000
+I will just open my browser, again in incognito mode.
+
+126
+00:05:03,000 --> 00:05:06,000
+So I will say new incognito mode.
+
+127
+00:05:06,000 --> 00:05:08,000
+And I will go to localhost:8080,
+
+128
+00:05:08,000 --> 00:05:10,000
+asking for the username password,
+
+129
+00:05:10,000 --> 00:05:12,000
+and we'll enter the username password,
+
+130
+00:05:12,000 --> 00:05:14,000
+which is mentioned in the database.
+
+131
+00:05:14,000 --> 00:05:15,000
+So let me go back to database to check.
+
+132
+00:05:15,000 --> 00:05:17,000
+So we have a username, kiran,
+
+133
+00:05:17,000 --> 00:05:20,000
+and the password is n@789.
+
+134
+00:05:20,000 --> 00:05:24,000
+So yeah, so kiran, it's n@789.
+
+135
+00:05:26,000 --> 00:05:28,000
+First of all, we'll give a wrong password to check.
+
+136
+00:05:28,000 --> 00:05:30,000
+So I will just enter some random data
+
+137
+00:05:30,000 --> 00:05:31,000
+and sign in, not working.
+
+138
+00:05:31,000 --> 00:05:35,000
+That's great. So the negative case is not working.
+
+139
+00:05:35,000 --> 00:05:37,000
+Let's try with positive values,
+
+140
+00:05:37,000 --> 00:05:41,000
+n@789, click on sign in, worked.
+
+141
+00:05:41,000 --> 00:05:41,000
+Okay.
+
+142
+00:05:41,000 --> 00:05:44,000
+So feeling better, when things works out, it feels better.
+
+143
+00:05:44,000 --> 00:05:46,000
+Okay, why we are getting error,
+
+144
+00:05:46,000 --> 00:05:48,000
+because we are not mapping for the homepage,
+
+145
+00:05:48,000 --> 00:05:49,000
+you can see we have it here.
+
+146
+00:05:49,000 --> 00:05:51,000
+Refresh, refresh, refresh. It works.
+
+147
+00:05:51,000 --> 00:05:53,000
+Now I will try a different user.
+
+148
+00:05:53,000 --> 00:05:56,000
+So again, incognito mode, localhost:8080,
+
+149
+00:05:56,000 --> 00:05:58,000
+again asking for username, password.
+
+150
+00:05:58,000 --> 00:06:02,000
+This time we'll go for harsh and h@123.
+
+151
+00:06:02,000 --> 00:06:07,000
+So I just go back here, I will say harsh, h@123, it worked.
+
+152
+00:06:09,000 --> 00:06:11,000
+Okay? So yeah.
+
+153
+00:06:11,000 --> 00:06:14,000
+So now we are actually connecting with database.
+
+154
+00:06:14,000 --> 00:06:16,000
+And you can see at one point when I was entering
+
+155
+00:06:16,000 --> 00:06:19,000
+a wrong username, we got the error which is User 404.
+
+156
+00:06:19,000 --> 00:06:22,000
+Okay, so if you don't have a proper username,
+
+157
+00:06:22,000 --> 00:06:24,000
+it will give you 404.
+
+158
+00:06:24,000 --> 00:06:25,000
+And that's the message we have, which you're printing.
+
+159
+00:06:25,000 --> 00:06:29,000
+And by doing this, we have implemented the entire stuff.
+
+160
+00:06:29,000 --> 00:06:31,000
+So what I'll do is in the next video, let's try
+
+161
+00:06:31,000 --> 00:06:34,000
+to go all the steps one by one,
+
+162
+00:06:34,000 --> 00:06:35,000
+which will make much more sense.
+
+163
+00:06:35,000 --> 00:06:38,000
+But what we have done in this video is we have created this
+
+164
+00:06:38,000 --> 00:06:41,000
+particular class called UserPrincipal,
+
+165
+00:06:41,000 --> 00:06:42,000
+which implements the UserDetails.
+
+166
+00:06:42,000 --> 00:06:43,000
+Of course, as I mentioned before,
+
+167
+00:06:43,000 --> 00:06:45,000
+you can have a different name,
+
+168
+00:06:45,000 --> 00:06:48,000
+but then principal simply means a current user, okay?
+
+169
+00:06:48,000 --> 00:06:50,000
+So whenever you are authenticating a user,
+
+170
+00:06:50,000 --> 00:06:52,000
+we call them as principals.
+
+171
+00:06:52,000 --> 00:06:54,000
+And in this principal, basically we have multiple methods
+
+172
+00:06:54,000 --> 00:06:57,000
+to work with, like getAuthorities, getUsername,
+
+173
+00:06:57,000 --> 00:07:00,000
+getPassword, and multiple settings here.
+
+174
+00:07:00,000 --> 00:07:02,000
+And if you want to have this feature in your project
+
+175
+00:07:02,000 --> 00:07:04,000
+where maybe after a few days,
+
+176
+00:07:04,000 --> 00:07:06,000
+you want to expire the credentials,
+
+177
+00:07:06,000 --> 00:07:08,000
+after a few days, maybe you want to,
+
+178
+00:07:08,000 --> 00:07:09,000
+if there's an inactive for a long time,
+
+179
+00:07:09,000 --> 00:07:11,000
+you can lock the account, you can expire the account,
+
+180
+00:07:11,000 --> 00:07:13,000
+you can do all those settings here.
+
+181
+00:07:13,000 --> 00:07:14,000
+But at this point I'm not doing it.
+
+182
+00:07:14,000 --> 00:07:16,000
+So yeah, in the next video, let's try
+
+183
+00:07:16,000 --> 00:07:17,000
+to understand the entire project.
+

20 - Spring Security/023 Summary till now_en.srt

@@ -0,0 +1,336 @@
+1
+00:00:00,000 --> 00:00:03,000
+(soft bright music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: So let's try to understand the project here.
+
+3
+00:00:05,000 --> 00:00:08,000
+So what I'll do is let's start with the security config.
+
+4
+00:00:08,000 --> 00:00:09,000
+Now what we are trying to do is
+
+5
+00:00:09,000 --> 00:00:13,000
+basically we want to verify the user from a database.
+
+6
+00:00:13,000 --> 00:00:15,000
+The data database which I'm using is Postgres.
+
+7
+00:00:15,000 --> 00:00:16,000
+So in our date table,
+
+8
+00:00:16,000 --> 00:00:19,000
+basically we have the ID, username and password.
+
+9
+00:00:19,000 --> 00:00:20,000
+The table name is users.
+
+10
+00:00:20,000 --> 00:00:21,000
+And to achieve that,
+
+11
+00:00:21,000 --> 00:00:24,000
+we have to change our authentication provider
+
+12
+00:00:24,000 --> 00:00:26,000
+and we want to say that I want to connect with database.
+
+13
+00:00:26,000 --> 00:00:30,000
+And to do that we have to use DAO authentication provider
+
+14
+00:00:30,000 --> 00:00:32,000
+because DAO is your database access.
+
+15
+00:00:32,000 --> 00:00:33,000
+And then to achieve that,
+
+16
+00:00:33,000 --> 00:00:36,000
+we have to specify the user details service
+
+17
+00:00:36,000 --> 00:00:38,000
+because if authentication provider wants to work,
+
+18
+00:00:38,000 --> 00:00:41,000
+it will ask you for the service class.
+
+19
+00:00:41,000 --> 00:00:42,000
+Now this service is an interface
+
+20
+00:00:42,000 --> 00:00:43,000
+which is user detailed service.
+
+21
+00:00:43,000 --> 00:00:45,000
+We have to implement it.
+
+22
+00:00:45,000 --> 00:00:46,000
+And the way we have implemented
+
+23
+00:00:46,000 --> 00:00:50,000
+is by creating a class called My User Detailed Service,
+
+24
+00:00:50,000 --> 00:00:52,000
+which implements the user detailed service
+
+25
+00:00:52,000 --> 00:00:54,000
+in which you have only one method,
+
+26
+00:00:54,000 --> 00:00:55,000
+which is load user by username.
+
+27
+00:00:55,000 --> 00:00:58,000
+But then since the data is coming from database,
+
+28
+00:00:58,000 --> 00:01:00,000
+we also need a user repo layer.
+
+29
+00:01:00,000 --> 00:01:03,000
+Now using this repo, which has a method
+
+30
+00:01:03,000 --> 00:01:07,000
+called find user by username, and we are using JPA,
+
+31
+00:01:07,000 --> 00:01:08,000
+so we don't have to write their skill queries.
+
+32
+00:01:08,000 --> 00:01:11,000
+What we are doing is we are firing a method
+
+33
+00:01:11,000 --> 00:01:12,000
+or we are calling a method
+
+34
+00:01:12,000 --> 00:01:14,000
+which returns you the object of user.
+
+35
+00:01:14,000 --> 00:01:15,000
+If the user is there,
+
+36
+00:01:15,000 --> 00:01:18,000
+then of course you have to return the object of user.
+
+37
+00:01:18,000 --> 00:01:19,000
+But if the user is not there,
+
+38
+00:01:19,000 --> 00:01:22,000
+we have to throw an exception,
+
+39
+00:01:22,000 --> 00:01:24,000
+but (indistinct) how will we return this user?
+
+40
+00:01:24,000 --> 00:01:27,000
+So we have to basically wrap this user object
+
+41
+00:01:27,000 --> 00:01:29,000
+into a user principle,
+
+42
+00:01:29,000 --> 00:01:33,000
+for extra things like expiry and all those stuff.
+
+43
+00:01:33,000 --> 00:01:34,000
+And to achieve that,
+
+44
+00:01:34,000 --> 00:01:37,000
+we have to implement the user details interface.
+
+45
+00:01:37,000 --> 00:01:39,000
+And we have done that in this class,
+
+46
+00:01:39,000 --> 00:01:41,000
+which is user principle.
+
+47
+00:01:41,000 --> 00:01:42,000
+Now, user principle is a class
+
+48
+00:01:42,000 --> 00:01:43,000
+which implements the user details
+
+49
+00:01:43,000 --> 00:01:45,000
+and principle means current user.
+
+50
+00:01:45,000 --> 00:01:49,000
+And in this particular class we have multiple methods,
+
+51
+00:01:49,000 --> 00:01:50,000
+three methods, one for authority,
+
+52
+00:01:50,000 --> 00:01:52,000
+one for username, one for password.
+
+53
+00:01:52,000 --> 00:01:54,000
+Apart from this, others are for your expiry,
+
+54
+00:01:54,000 --> 00:01:57,000
+for your account, and for your credentials.
+
+55
+00:01:57,000 --> 00:02:00,000
+And then, you know, basically just to give you a summary,
+
+56
+00:02:00,000 --> 00:02:04,000
+in a bank account, you get a notification
+
+57
+00:02:04,000 --> 00:02:05,000
+after every one month or three months
+
+58
+00:02:05,000 --> 00:02:07,000
+that change your password.
+
+59
+00:02:07,000 --> 00:02:09,000
+That's how they basically set this up. Okay?
+
+60
+00:02:09,000 --> 00:02:11,000
+So yeah, but then we have not done that.
+
+61
+00:02:11,000 --> 00:02:14,000
+So we have only focused on this three.
+
+62
+00:02:14,000 --> 00:02:17,000
+And all this thing, basically you have your table
+
+63
+00:02:17,000 --> 00:02:19,000
+and your class, which represents that,
+
+64
+00:02:19,000 --> 00:02:20,000
+which is your user class,
+
+65
+00:02:20,000 --> 00:02:22,000
+which is an entity which has three columns.
+
+66
+00:02:22,000 --> 00:02:25,000
+Now depended upon your number of columns in the table,
+
+67
+00:02:25,000 --> 00:02:25,000
+this will change.
+
+68
+00:02:25,000 --> 00:02:28,000
+So if you have three columns, you'll have three properties.
+
+69
+00:02:28,000 --> 00:02:30,000
+If you have five columns, you'll have five properties here.
+
+70
+00:02:30,000 --> 00:02:32,000
+Which you want to map and that's how it is working.
+
+71
+00:02:32,000 --> 00:02:33,000
+A few other changes which you have made
+
+72
+00:02:33,000 --> 00:02:34,000
+in the operation properties,
+
+73
+00:02:34,000 --> 00:02:36,000
+we have specified the properties
+
+74
+00:02:36,000 --> 00:02:38,000
+to connect with the Postgres.
+
+75
+00:02:38,000 --> 00:02:40,000
+If you have a different DBMS, you will change this.
+
+76
+00:02:40,000 --> 00:02:43,000
+And also in the xml file, we have to mention two things,
+
+77
+00:02:43,000 --> 00:02:46,000
+the JP repository, the data JPA,
+
+78
+00:02:46,000 --> 00:02:48,000
+and we have to mention the post quiz.
+
+79
+00:02:48,000 --> 00:02:50,000
+And by doing this, the security is working.
+
+80
+00:02:50,000 --> 00:02:54,000
+Your application is secure with the help of database,
+
+81
+00:02:54,000 --> 00:02:56,000
+but it's not completely secure
+
+82
+00:02:56,000 --> 00:03:00,000
+because we are still storing data in the plain text.
+
+83
+00:03:00,000 --> 00:03:01,000
+We have to change this.
+
+84
+00:03:01,000 --> 00:03:03,000
+Let's do that in the upcoming videos.
+

20 - Spring Security/024 What is Bcrypt_en.srt

@@ -0,0 +1,636 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:04,000
+-: So 'til this point,
+
+3
+00:00:04,000 --> 00:00:07,000
+we were able to store data in database.
+
+4
+00:00:07,000 --> 00:00:09,000
+Basically, when I say data, I'm talking about the users
+
+5
+00:00:09,000 --> 00:00:11,000
+and then we can validate them with the help
+
+6
+00:00:11,000 --> 00:00:12,000
+of username, password.
+
+7
+00:00:12,000 --> 00:00:16,000
+And we are securing this with the help of spring security.
+
+8
+00:00:16,000 --> 00:00:18,000
+And for that we have created multiple files.
+
+9
+00:00:18,000 --> 00:00:21,000
+If you look at the logic, logic files are very less.
+
+10
+00:00:21,000 --> 00:00:23,000
+If you compare here, we got hello controller,
+
+11
+00:00:23,000 --> 00:00:25,000
+student controller, student.
+
+12
+00:00:25,000 --> 00:00:26,000
+I think that's it.
+
+13
+00:00:26,000 --> 00:00:28,000
+Those are your actual logic files
+
+14
+00:00:28,000 --> 00:00:32,000
+and others are your configuration files for Spring Security.
+
+15
+00:00:32,000 --> 00:00:34,000
+And maybe you're thinking, security files
+
+16
+00:00:34,000 --> 00:00:36,000
+are more than the actual logic.
+
+17
+00:00:36,000 --> 00:00:38,000
+See, once you talk about the big application,
+
+18
+00:00:38,000 --> 00:00:41,000
+you'll be having more files, not just two.
+
+19
+00:00:41,000 --> 00:00:42,000
+You'll be having multiple there,
+
+20
+00:00:42,000 --> 00:00:44,000
+maybe 50, 60 doesn't matter.
+
+21
+00:00:44,000 --> 00:00:46,000
+But the configuration files are limited.
+
+22
+00:00:46,000 --> 00:00:48,000
+So you can see we have this number of config files.
+
+23
+00:00:48,000 --> 00:00:51,000
+It might increase and it will in the upcoming videos.
+
+24
+00:00:51,000 --> 00:00:53,000
+But then this is the basic layout out we have.
+
+25
+00:00:53,000 --> 00:00:55,000
+And everything is working at this point, right?
+
+26
+00:00:55,000 --> 00:00:57,000
+We were able to run this application,
+
+27
+00:00:57,000 --> 00:00:59,000
+we were able to log in as well.
+
+28
+00:00:59,000 --> 00:01:00,000
+But there's one little problem.
+
+29
+00:01:00,000 --> 00:01:02,000
+The problem is, not a little problem.
+
+30
+00:01:02,000 --> 00:01:04,000
+It's actually a big problem.
+
+31
+00:01:04,000 --> 00:01:05,000
+If we look at our database,
+
+32
+00:01:05,000 --> 00:01:07,000
+we are storing our password in a plain text,
+
+33
+00:01:07,000 --> 00:01:09,000
+not a good sight, right?
+
+34
+00:01:09,000 --> 00:01:13,000
+So not just we are storing data in a plain text,
+
+35
+00:01:13,000 --> 00:01:16,000
+but also we are transferring this data in a plain text.
+
+36
+00:01:16,000 --> 00:01:19,000
+So how do you secure this?
+
+37
+00:01:19,000 --> 00:01:20,000
+So one thing you can do
+
+38
+00:01:20,000 --> 00:01:22,000
+is you can use something called a cryptography here.
+
+39
+00:01:22,000 --> 00:01:25,000
+Now in cryptography, basically we have a concept
+
+40
+00:01:25,000 --> 00:01:29,000
+of cryptography where you encrypt a message
+
+41
+00:01:29,000 --> 00:01:31,000
+and then on the other hand, you decrypt it.
+
+42
+00:01:31,000 --> 00:01:34,000
+So basically what I'm saying is when you want
+
+43
+00:01:34,000 --> 00:01:37,000
+to store a password, you can encrypt a password with a key,
+
+44
+00:01:37,000 --> 00:01:39,000
+and then when you want to verify the password,
+
+45
+00:01:39,000 --> 00:01:42,000
+you can decrypt the data and you can verify the password.
+
+46
+00:01:42,000 --> 00:01:46,000
+Example, let's say we have storing h@123 here.
+
+47
+00:01:46,000 --> 00:01:49,000
+we can change this value, we can encrypt this value.
+
+48
+00:01:49,000 --> 00:01:51,000
+And maybe the new output you got is,
+
+49
+00:01:51,000 --> 00:01:54,000
+let me write the new output here, some random value here.
+
+50
+00:01:54,000 --> 00:01:56,000
+Let's say this is your output for this encryption.
+
+51
+00:01:56,000 --> 00:01:58,000
+And then this is what you will be storing
+
+52
+00:01:58,000 --> 00:02:00,000
+in a password field in the database.
+
+53
+00:02:00,000 --> 00:02:02,000
+When you want to verify,
+
+54
+00:02:02,000 --> 00:02:04,000
+of course a user will not enter this value.
+
+55
+00:02:04,000 --> 00:02:06,000
+User will enter h at rate 123.
+
+56
+00:02:06,000 --> 00:02:08,000
+Then you have to decrypt this
+
+57
+00:02:08,000 --> 00:02:10,000
+and you have to get the password
+
+58
+00:02:10,000 --> 00:02:12,000
+and you can verify that point.
+
+59
+00:02:12,000 --> 00:02:12,000
+That's one way.
+
+60
+00:02:12,000 --> 00:02:13,000
+The problem with this is
+
+61
+00:02:13,000 --> 00:02:15,000
+when you have the encryption technique
+
+62
+00:02:15,000 --> 00:02:17,000
+for cryptography, you have a key, right?
+
+63
+00:02:17,000 --> 00:02:19,000
+And some way it is not that safe
+
+64
+00:02:19,000 --> 00:02:21,000
+because if you get the key, you are gone.
+
+65
+00:02:21,000 --> 00:02:22,000
+All the passwords are linked.
+
+66
+00:02:22,000 --> 00:02:24,000
+The other way you can do
+
+67
+00:02:24,000 --> 00:02:25,000
+is you can have a one way encryption,
+
+68
+00:02:25,000 --> 00:02:27,000
+which is called hashing basically.
+
+69
+00:02:27,000 --> 00:02:30,000
+In hashing, you don't decrypt the message.
+
+70
+00:02:30,000 --> 00:02:34,000
+Example, if this is your, okay, this is not a valid one
+
+71
+00:02:34,000 --> 00:02:36,000
+because it will beg a decimal.
+
+72
+00:02:36,000 --> 00:02:39,000
+But for that matter, let's say we have this value.
+
+73
+00:02:39,000 --> 00:02:42,000
+Now let's say this is your hash, okay?
+
+74
+00:02:42,000 --> 00:02:44,000
+Now hash is basically one way.
+
+75
+00:02:44,000 --> 00:02:46,000
+So for every data, you will get only one hash.
+
+76
+00:02:46,000 --> 00:02:48,000
+There's no collision here.
+
+77
+00:02:48,000 --> 00:02:50,000
+Now what will happen is you can't get it back.
+
+78
+00:02:50,000 --> 00:02:53,000
+So you can't simply go from this particular output
+
+79
+00:02:53,000 --> 00:02:57,000
+to h at 123, because that's one way.
+
+80
+00:02:57,000 --> 00:02:58,000
+Now, how do we verify this?
+
+81
+00:02:58,000 --> 00:03:02,000
+So every time a user enters h at rate 123,
+
+82
+00:03:02,000 --> 00:03:04,000
+then you convert that into a hash again.
+
+83
+00:03:04,000 --> 00:03:06,000
+And then you compare this two hash.
+
+84
+00:03:06,000 --> 00:03:07,000
+If they are matching, that's good, right?
+
+85
+00:03:07,000 --> 00:03:09,000
+Now what are the algorithms we have?
+
+86
+00:03:09,000 --> 00:03:11,000
+So for hashing, we have different algorithms available.
+
+87
+00:03:11,000 --> 00:03:15,000
+We got MD5, we got SHA256,
+
+88
+00:03:15,000 --> 00:03:17,000
+but then we want a more secure way of doing it
+
+89
+00:03:17,000 --> 00:03:20,000
+and the secure way of doing it, what if you can use SHA,
+
+90
+00:03:20,000 --> 00:03:23,000
+but not just in one round, in multiple rounds?
+
+91
+00:03:23,000 --> 00:03:26,000
+So what hashing does is, basically it converts your text
+
+92
+00:03:26,000 --> 00:03:29,000
+into a numbers using hashing algorithm.
+
+93
+00:03:29,000 --> 00:03:31,000
+This is one of the algorithm we have.
+
+94
+00:03:31,000 --> 00:03:33,000
+And then it will do only once.
+
+95
+00:03:33,000 --> 00:03:35,000
+But what if you can repeat this process multiple times,
+
+96
+00:03:35,000 --> 00:03:38,000
+1, 2, times, 10 times, 100 times?
+
+97
+00:03:38,000 --> 00:03:41,000
+And if we can do that, it'll be difficult for anyone
+
+98
+00:03:41,000 --> 00:03:43,000
+to hack or to get the password.
+
+99
+00:03:43,000 --> 00:03:45,000
+And to achieve that, we are going
+
+100
+00:03:45,000 --> 00:03:46,000
+to use some other technique
+
+101
+00:03:46,000 --> 00:03:50,000
+and we have to use algorithm called bcrypt.
+
+102
+00:03:50,000 --> 00:03:52,000
+So how do we use bcrypt here?
+
+103
+00:03:52,000 --> 00:03:54,000
+And you will, it will make much more sense
+
+104
+00:03:54,000 --> 00:03:56,000
+once we start implementing it.
+
+105
+00:03:56,000 --> 00:04:00,000
+But bcrypt will help you to generate a password
+
+106
+00:04:00,000 --> 00:04:02,000
+or it will encode your password.
+
+107
+00:04:02,000 --> 00:04:04,000
+To show an example, I will open my browser, I'll search
+
+108
+00:04:04,000 --> 00:04:08,000
+for bcrypt password generator, you can see here.
+
+109
+00:04:08,000 --> 00:04:09,000
+And I will go through this website,
+
+110
+00:04:09,000 --> 00:04:12,000
+which I have used multiple times and it is not coming up.
+
+111
+00:04:12,000 --> 00:04:14,000
+All I can see is ads.
+
+112
+00:04:14,000 --> 00:04:16,000
+Okay, it's here, second only.
+
+113
+00:04:16,000 --> 00:04:19,000
+So you got this website, which is browser link.
+
+114
+00:04:19,000 --> 00:04:21,000
+And here basically you can get your password.
+
+115
+00:04:21,000 --> 00:04:24,000
+So let's say I want to get the bcrypt password.
+
+116
+00:04:24,000 --> 00:04:27,000
+So I will enter maybe h at the rate 123,
+
+117
+00:04:27,000 --> 00:04:29,000
+and I can click on bcrypt.
+
+118
+00:04:29,000 --> 00:04:32,000
+So you can see this is the encoded format.
+
+119
+00:04:32,000 --> 00:04:34,000
+Okay, so we are using a password encoder now,
+
+120
+00:04:34,000 --> 00:04:37,000
+which is bcrypt, and it, this is your encoded format.
+
+121
+00:04:37,000 --> 00:04:38,000
+And if you look at this format,
+
+122
+00:04:38,000 --> 00:04:40,000
+of course you have some weird values here,
+
+123
+00:04:40,000 --> 00:04:41,000
+but if you look at the first one,
+
+124
+00:04:41,000 --> 00:04:44,000
+so $2A is a version for bcrypt.
+
+125
+00:04:44,000 --> 00:04:46,000
+So that different versions are available.
+
+126
+00:04:46,000 --> 00:04:48,000
+We got 2A, 2Y also.
+
+127
+00:04:48,000 --> 00:04:50,000
+And then after this we have $10,
+
+128
+00:04:50,000 --> 00:04:52,000
+which is basically your number of rounds.
+
+129
+00:04:52,000 --> 00:04:54,000
+So you can see, I'm saying 10 rounds here.
+
+130
+00:04:54,000 --> 00:04:55,000
+So by default it will be 10 rounds,
+
+131
+00:04:55,000 --> 00:04:57,000
+but you can change the rounds here.
+
+132
+00:04:57,000 --> 00:04:59,000
+So I can say 12 rounds.
+
+133
+00:04:59,000 --> 00:05:00,000
+And now when I click on bcrypt,
+
+134
+00:05:00,000 --> 00:05:02,000
+you will get a different number.
+
+135
+00:05:02,000 --> 00:05:04,000
+Of course, you will get a different string here.
+
+136
+00:05:04,000 --> 00:05:07,000
+And we got $12, which is 12 rounds.
+
+137
+00:05:07,000 --> 00:05:08,000
+Okay.
+
+138
+00:05:08,000 --> 00:05:10,000
+Now when I say 12 rounds,
+
+139
+00:05:10,000 --> 00:05:12,000
+it is actually two raised to 12 rounds.
+
+140
+00:05:12,000 --> 00:05:14,000
+It's not just 12 rounds, okay?
+
+141
+00:05:14,000 --> 00:05:16,000
+So it's a huge number.
+
+142
+00:05:16,000 --> 00:05:17,000
+So if you divide in half to leave with 10
+
+143
+00:05:17,000 --> 00:05:18,000
+so it is 2 raised to 10,
+
+144
+00:05:18,000 --> 00:05:20,000
+which is that number of rounds,
+
+145
+00:05:20,000 --> 00:05:21,000
+it will take 200, this text here
+
+146
+00:05:21,000 --> 00:05:24,000
+So it is very difficult for anyone to hack it.
+
+147
+00:05:24,000 --> 00:05:26,000
+So even if they want to do a brute force,
+
+148
+00:05:26,000 --> 00:05:28,000
+they have to do this multiple times.
+
+149
+00:05:28,000 --> 00:05:31,000
+And every time you do a hashing, it takes some time,
+
+150
+00:05:31,000 --> 00:05:33,000
+it takes some computation.
+
+151
+00:05:33,000 --> 00:05:34,000
+So that means if you do computation,
+
+152
+00:05:34,000 --> 00:05:37,000
+let's say if you do it only for once, one round,
+
+153
+00:05:37,000 --> 00:05:38,000
+let's say if it takes one milliseconds,
+
+154
+00:05:38,000 --> 00:05:41,000
+imagine if you do 4,000 rounds.
+
+155
+00:05:41,000 --> 00:05:43,000
+That's huge, right?
+
+156
+00:05:43,000 --> 00:05:46,000
+So it will make sure that it will be less vulnerable
+
+157
+00:05:46,000 --> 00:05:50,000
+compared to the plain text and even for SHA256.
+
+158
+00:05:50,000 --> 00:05:52,000
+Now how we are going to use this in our code?
+
+159
+00:05:52,000 --> 00:05:55,000
+That's what we are going to see on the upcoming videos.
+

20 - Spring Security/025 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.25%20User%20Registration/spring-sec-demo

20 - Spring Security/025 User Registration_en.srt

@@ -0,0 +1,524 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:06,000
+-: So now, we have to implement the Password Encoder,
+
+3
+00:00:06,000 --> 00:00:07,000
+which is Bcrypt.
+
+4
+00:00:07,000 --> 00:00:09,000
+But before that, we want to also create a user option.
+
+5
+00:00:09,000 --> 00:00:12,000
+So basically, I want an option where a user can register,
+
+6
+00:00:12,000 --> 00:00:13,000
+right?
+
+7
+00:00:13,000 --> 00:00:16,000
+And to do that, what I will do is I will create a controller
+
+8
+00:00:16,000 --> 00:00:18,000
+where a user can send a request to register.
+
+9
+00:00:18,000 --> 00:00:21,000
+And I will save this as UserController
+
+10
+00:00:21,000 --> 00:00:23,000
+in the controller package.
+
+11
+00:00:23,000 --> 00:00:28,000
+And we need to make sure that this is RestController.
+
+12
+00:00:28,000 --> 00:00:30,000
+And then, we'll create an endpoint.
+
+13
+00:00:30,000 --> 00:00:32,000
+So the endpoint here will be "public",
+
+14
+00:00:32,000 --> 00:00:35,000
+and I want to return the same user, which I'm creating.
+
+15
+00:00:35,000 --> 00:00:37,000
+So I will say a "User".
+
+16
+00:00:37,000 --> 00:00:39,000
+But unfortunately, we don't have.
+
+17
+00:00:39,000 --> 00:00:40,000
+Okay, we do have a user, okay?
+
+18
+00:00:40,000 --> 00:00:41,000
+So we can say "User".
+
+19
+00:00:41,000 --> 00:00:44,000
+And then I will say "register"
+
+20
+00:00:44,000 --> 00:00:46,000
+in which I am going to accept the object of register.
+
+21
+00:00:46,000 --> 00:00:50,000
+So I will say "RequestBody User_user".
+
+22
+00:00:52,000 --> 00:00:55,000
+And then, let's return the same user.
+
+23
+00:00:55,000 --> 00:00:58,000
+Okay, and then this should be mapped with a "Get".
+
+24
+00:00:58,000 --> 00:00:59,000
+No, not GetMapping, PostMapping,
+
+25
+00:00:59,000 --> 00:01:01,000
+because we will be sending data.
+
+26
+00:01:01,000 --> 00:01:05,000
+And here I will say "register".
+
+27
+00:01:05,000 --> 00:01:07,000
+So now, using this particular URL,
+
+28
+00:01:07,000 --> 00:01:09,000
+we can send a request for the registration,
+
+29
+00:01:09,000 --> 00:01:10,000
+and then we are simply returning it.
+
+30
+00:01:10,000 --> 00:01:12,000
+Of course, I want to store that somewhere, right?
+
+31
+00:01:12,000 --> 00:01:14,000
+So where do you want to store it?
+
+32
+00:01:14,000 --> 00:01:15,000
+Of course, in the database.
+
+33
+00:01:15,000 --> 00:01:20,000
+And to do that, I will create a service class for the user.
+
+34
+00:01:20,000 --> 00:01:22,000
+And I will say, this is UserService.
+
+35
+00:01:24,000 --> 00:01:26,000
+I will integrate this with a Service.
+
+36
+00:01:26,000 --> 00:01:28,000
+And then, here we'll have a method.
+
+37
+00:01:28,000 --> 00:01:30,000
+So I will say "public_User",
+
+38
+00:01:30,000 --> 00:01:34,000
+and I will say, "Save", maybe "saveUser".
+
+39
+00:01:34,000 --> 00:01:36,000
+And here, let's import the package.
+
+40
+00:01:36,000 --> 00:01:37,000
+Okay, so from the controller,
+
+41
+00:01:37,000 --> 00:01:39,000
+basically I have to send the user object
+
+42
+00:01:39,000 --> 00:01:43,000
+and then I can save that object in database, okay?
+
+43
+00:01:43,000 --> 00:01:45,000
+But then to store that in database,
+
+44
+00:01:45,000 --> 00:01:47,000
+let me return the same object first.
+
+45
+00:01:47,000 --> 00:01:48,000
+At this point, we are doing that.
+
+46
+00:01:48,000 --> 00:01:50,000
+Let's send the same object.
+
+47
+00:01:50,000 --> 00:01:51,000
+But I want to store it in database, right?
+
+48
+00:01:51,000 --> 00:01:53,000
+So for database, we already have a Repo.
+
+49
+00:01:53,000 --> 00:01:56,000
+So if you see we do have a UserRepo, and we can use this.
+
+50
+00:01:56,000 --> 00:02:00,000
+So I can simply create object of UserRepo.
+
+51
+00:02:00,000 --> 00:02:01,000
+I will say Repo.
+
+52
+00:02:01,000 --> 00:02:04,000
+And then we have to AutoWire this.
+
+53
+00:02:04,000 --> 00:02:05,000
+Okay.
+
+54
+00:02:05,000 --> 00:02:06,000
+And now with this particular Repo,
+
+55
+00:02:06,000 --> 00:02:11,000
+I can call it save and I can pass the user.
+
+56
+00:02:11,000 --> 00:02:13,000
+So basically, whatever data I'm getting from the controller,
+
+57
+00:02:13,000 --> 00:02:15,000
+I'm just passing it to the repository layer.
+
+58
+00:02:15,000 --> 00:02:18,000
+And we are calling it the save method.
+
+59
+00:02:18,000 --> 00:02:19,000
+And of course, the repository layer will
+
+60
+00:02:19,000 --> 00:02:20,000
+take care of the method execution
+
+61
+00:02:20,000 --> 00:02:22,000
+because we are using .jpa here, okay?
+
+62
+00:02:22,000 --> 00:02:23,000
+And I hope this will work.
+
+63
+00:02:23,000 --> 00:02:25,000
+So basically, I'm passing the object,
+
+64
+00:02:25,000 --> 00:02:27,000
+I'm just asking service layer to add it.
+
+65
+00:02:27,000 --> 00:02:29,000
+And we have not implemented Bcrypt yet.
+
+66
+00:02:29,000 --> 00:02:30,000
+We'll do that.
+
+67
+00:02:30,000 --> 00:02:31,000
+I'm just going step by step.
+
+68
+00:02:31,000 --> 00:02:32,000
+I want to register the user first.
+
+69
+00:02:32,000 --> 00:02:35,000
+And this is looking good.
+
+70
+00:02:35,000 --> 00:02:38,000
+So let me see if the project is running, it's not.
+
+71
+00:02:38,000 --> 00:02:39,000
+So I will just run this.
+
+72
+00:02:39,000 --> 00:02:42,000
+And now, let's head back to our Postman.
+
+73
+00:02:42,000 --> 00:02:44,000
+The request which we are sending now is for register.
+
+74
+00:02:44,000 --> 00:02:46,000
+Let's verify the Headers
+
+75
+00:02:46,000 --> 00:02:48,000
+and in fact, authorization.
+
+76
+00:02:48,000 --> 00:02:49,000
+This should not be "telusko",
+
+77
+00:02:49,000 --> 00:02:51,000
+this should be,
+
+78
+00:02:51,000 --> 00:02:55,000
+let's go with harsh and h@123.
+
+79
+00:02:55,000 --> 00:02:58,000
+So I'll say this is harsh and h@123.
+
+80
+00:02:58,000 --> 00:03:01,000
+That's the Username-Password we have in table.
+
+81
+00:03:01,000 --> 00:03:04,000
+And now, we have to pass data as well.
+
+82
+00:03:04,000 --> 00:03:05,000
+So basically, we already have some data here.
+
+83
+00:03:05,000 --> 00:03:06,000
+I don't want to use this.
+
+84
+00:03:06,000 --> 00:03:08,000
+Let's say, I want to say "id" is 3.
+
+85
+00:03:08,000 --> 00:03:10,000
+Name, I will register myself
+
+86
+00:03:10,000 --> 00:03:12,000
+because in database, I don't have my name.
+
+87
+00:03:12,000 --> 00:03:13,000
+So I'll say Navin.
+
+88
+00:03:13,000 --> 00:03:15,000
+And the password, so it should be not Name,
+
+89
+00:03:15,000 --> 00:03:16,000
+it should be "username".
+
+90
+00:03:16,000 --> 00:03:20,000
+This should match with your class, the user class.
+
+91
+00:03:20,000 --> 00:03:22,000
+And this is your password.
+
+92
+00:03:22,000 --> 00:03:26,000
+And the password I want to store is "n@345".
+
+93
+00:03:28,000 --> 00:03:30,000
+Okay, that's the password I have.
+
+94
+00:03:30,000 --> 00:03:33,000
+And now, let's click on Send.
+
+95
+00:03:33,000 --> 00:03:35,000
+Usually, I will give a wrong password just to see.
+
+96
+00:03:35,000 --> 00:03:38,000
+Let's say I'm passing password four,
+
+97
+00:03:38,000 --> 00:03:39,000
+fourth authorization,
+
+98
+00:03:39,000 --> 00:03:41,000
+and I'm creating a new record with this data.
+
+99
+00:03:41,000 --> 00:03:42,000
+Click on Send, it failed.
+
+100
+00:03:42,000 --> 00:03:44,000
+You can see we got 401.
+
+101
+00:03:44,000 --> 00:03:47,000
+Let's pass the right password, which is 123.
+
+102
+00:03:47,000 --> 00:03:48,000
+Click on Send.
+
+103
+00:03:48,000 --> 00:03:51,000
+And you can see that this time we got 200.
+
+104
+00:03:51,000 --> 00:03:53,000
+And we also got the data in back, which is this data,
+
+105
+00:03:53,000 --> 00:03:54,000
+which is stored in database.
+
+106
+00:03:54,000 --> 00:03:56,000
+How do I verify this?
+
+107
+00:03:56,000 --> 00:03:59,000
+Let's go back to our database and say "select * from users"
+
+108
+00:03:59,000 --> 00:04:00,000
+Run.
+
+109
+00:04:00,000 --> 00:04:02,000
+Okay, it's not working.
+
+110
+00:04:02,000 --> 00:04:05,000
+So maybe I have to reload.
+
+111
+00:04:06,000 --> 00:04:08,000
+Okay, you know what?
+
+112
+00:04:08,000 --> 00:04:11,000
+I'm not calling anyone "Service service" layer, my bad.
+
+113
+00:04:11,000 --> 00:04:16,000
+So this should be object of "private UserService service".
+
+114
+00:04:18,000 --> 00:04:21,000
+And then we have to annotate this with "Autowired".
+
+115
+00:04:21,000 --> 00:04:23,000
+And now, I can use a service.
+
+116
+00:04:23,000 --> 00:04:26,000
+In fact, service returns this object, right?
+
+117
+00:04:26,000 --> 00:04:29,000
+So it's a "service.saveUser" and pass the user object.
+
+118
+00:04:29,000 --> 00:04:31,000
+This is the steps which was missing.
+
+119
+00:04:31,000 --> 00:04:32,000
+Let's restart.
+
+120
+00:04:32,000 --> 00:04:34,000
+I don't want to depend upon the hot reload.
+
+121
+00:04:34,000 --> 00:04:37,000
+Okay, let's go back to Postman, answer issue again.
+
+122
+00:04:37,000 --> 00:04:40,000
+Okay, this time also, we got this user here,
+
+123
+00:04:40,000 --> 00:04:42,000
+but the way you can verify that
+
+124
+00:04:42,000 --> 00:04:44,000
+is with the help of database and it worked.
+
+125
+00:04:44,000 --> 00:04:45,000
+You can see we got a new user.
+
+126
+00:04:45,000 --> 00:04:48,000
+So this is also layer, which we have done.
+
+127
+00:04:48,000 --> 00:04:49,000
+And now, in the next video,
+
+128
+00:04:49,000 --> 00:04:52,000
+let's try to implement Bcrypt here.
+
+129
+00:04:52,000 --> 00:04:54,000
+So basically, I want to create a user
+
+130
+00:04:54,000 --> 00:04:56,000
+with a Bcrypt implementation.
+
+131
+00:04:56,000 --> 00:04:58,000
+So see you in the next video.
+

20 - Spring Security/026 BCrypt Encoding for User Registration_en.srt

@@ -0,0 +1,568 @@
+1
+00:00:00,000 --> 00:00:03,000
+(logo chimes)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: Now, let's implement the bcrypt.
+
+3
+00:00:05,000 --> 00:00:06,000
+But, you know,
+
+4
+00:00:06,000 --> 00:00:08,000
+even if you implement bcrypt for the registration
+
+5
+00:00:08,000 --> 00:00:10,000
+and for the searching, see, what happens is,
+
+6
+00:00:10,000 --> 00:00:12,000
+when you register a new user,
+
+7
+00:00:12,000 --> 00:00:14,000
+and even if you send request
+
+8
+00:00:14,000 --> 00:00:15,000
+with this data which you're sending.
+
+9
+00:00:15,000 --> 00:00:16,000
+Let's say we have a new user.
+
+10
+00:00:16,000 --> 00:00:18,000
+This time we'll say 4.
+
+11
+00:00:18,000 --> 00:00:20,000
+And I will say avni.
+
+12
+00:00:20,000 --> 00:00:24,000
+And this is let's say a@123.
+
+13
+00:00:24,000 --> 00:00:27,000
+Now, if this is my new user, it should work, right?
+
+14
+00:00:27,000 --> 00:00:28,000
+But then, the moment you implement bcrypt,
+
+15
+00:00:28,000 --> 00:00:31,000
+and if you go back to your authorization,
+
+16
+00:00:31,000 --> 00:00:33,000
+here you can see we are sending a plain password.
+
+17
+00:00:33,000 --> 00:00:36,000
+And, of course, you have to send plain password.
+
+18
+00:00:36,000 --> 00:00:38,000
+But in the database as well, we're having a plain password.
+
+19
+00:00:38,000 --> 00:00:40,000
+And the moment you implement bcrypt,
+
+20
+00:00:40,000 --> 00:00:41,000
+it'll try to encode that, right?
+
+21
+00:00:41,000 --> 00:00:43,000
+So, we have to also make sure
+
+22
+00:00:43,000 --> 00:00:44,000
+that you change one of the field here.
+
+23
+00:00:44,000 --> 00:00:46,000
+So, let's say I want to change
+
+24
+00:00:46,000 --> 00:00:47,000
+the navin's password to something else,
+
+25
+00:00:47,000 --> 00:00:49,000
+some new password here.
+
+26
+00:00:49,000 --> 00:00:50,000
+And the way you can do that is,
+
+27
+00:00:50,000 --> 00:00:52,000
+I will file the update query.
+
+28
+00:00:52,000 --> 00:00:54,000
+So, update users
+
+29
+00:00:54,000 --> 00:00:59,000
+and I will set the password is equal to
+
+30
+00:01:00,000 --> 00:01:03,000
+something where the id=3.
+
+31
+00:01:03,000 --> 00:01:05,000
+So, basically, I'm changing this particular record here,
+
+32
+00:01:05,000 --> 00:01:06,000
+the third record.
+
+33
+00:01:06,000 --> 00:01:08,000
+But then, what should be the password?
+
+34
+00:01:08,000 --> 00:01:11,000
+I want to find the bcrypt of this. How do I get that?
+
+35
+00:01:11,000 --> 00:01:12,000
+I will just simply copy this,
+
+36
+00:01:12,000 --> 00:01:16,000
+and, remember, this website where we created a password.
+
+37
+00:01:16,000 --> 00:01:18,000
+I will just enter that here.
+
+38
+00:01:18,000 --> 00:01:21,000
+And let me just go with the default one, which is 10.
+
+39
+00:01:21,000 --> 00:01:22,000
+Or, maybe I will just go with 12
+
+40
+00:01:22,000 --> 00:01:24,000
+because I'm going to use that everywhere.
+
+41
+00:01:24,000 --> 00:01:26,000
+So, I'm going for Rounds 12.
+
+42
+00:01:26,000 --> 00:01:28,000
+And this is a password which I want to convert.
+
+43
+00:01:28,000 --> 00:01:29,000
+I will say Bcrypt.
+
+44
+00:01:29,000 --> 00:01:31,000
+Now, this is your new password,
+
+45
+00:01:31,000 --> 00:01:34,000
+so I'll just copy this and store that here,
+
+46
+00:01:34,000 --> 00:01:36,000
+so that at least I can authorize it.
+
+47
+00:01:36,000 --> 00:01:38,000
+And this is a new password, and the way we can verify...
+
+48
+00:01:38,000 --> 00:01:40,000
+Okay , we have to execute this as well.
+
+49
+00:01:40,000 --> 00:01:43,000
+Run. Okay.
+
+50
+00:01:45,000 --> 00:01:47,000
+Also run, okay, update done.
+
+51
+00:01:47,000 --> 00:01:49,000
+And now, I will file the query,
+
+52
+00:01:49,000 --> 00:01:51,000
+and you can see we got the new password there.
+
+53
+00:01:51,000 --> 00:01:54,000
+Now, once you have this new password, I can go back here,
+
+54
+00:01:54,000 --> 00:01:57,000
+and let me log in with navin,
+
+55
+00:01:57,000 --> 00:02:01,000
+and the password is n@345.
+
+56
+00:02:01,000 --> 00:02:03,000
+Now, of course, from the field you have to pass this.
+
+57
+00:02:03,000 --> 00:02:06,000
+Then, in between it'll convert that into bcrypt.
+
+58
+00:02:06,000 --> 00:02:08,000
+But how will you convert that?
+
+59
+00:02:08,000 --> 00:02:11,000
+So, let me go back to my code and let's do the actual work.
+
+60
+00:02:11,000 --> 00:02:14,000
+So, when I say register in this service layer,
+
+61
+00:02:14,000 --> 00:02:16,000
+before you register the user,
+
+62
+00:02:16,000 --> 00:02:18,000
+this is where we have to change it, right?
+
+63
+00:02:18,000 --> 00:02:20,000
+So, I want to change the user data.
+
+64
+00:02:20,000 --> 00:02:22,000
+I have to set the new password.
+
+65
+00:02:22,000 --> 00:02:24,000
+So, instead of storing the password, which is in plain text,
+
+66
+00:02:24,000 --> 00:02:26,000
+I want to store that in the bcrypt.
+
+67
+00:02:26,000 --> 00:02:28,000
+So, I want to convert the password,
+
+68
+00:02:28,000 --> 00:02:29,000
+which I'm getting from the user,
+
+69
+00:02:29,000 --> 00:02:31,000
+which is, by default, the plain text,
+
+70
+00:02:31,000 --> 00:02:33,000
+to our encrypted format.
+
+71
+00:02:33,000 --> 00:02:34,000
+And to achieve that,
+
+72
+00:02:34,000 --> 00:02:37,000
+we can use something called a bcrypt encoder.
+
+73
+00:02:37,000 --> 00:02:40,000
+And to use that, we have to get object of bcrypt.
+
+74
+00:02:40,000 --> 00:02:43,000
+I'll say private BcryptPasswordEncoder.
+
+75
+00:02:44,000 --> 00:02:46,000
+And if you're thinking we are using something else,
+
+76
+00:02:46,000 --> 00:02:49,000
+so we have to add a extra library, no,
+
+77
+00:02:49,000 --> 00:02:50,000
+it's a part of Spring Security.
+
+78
+00:02:50,000 --> 00:02:52,000
+So, you can see BcryptPasswordEncoder
+
+79
+00:02:52,000 --> 00:02:54,000
+is a part of Spring Security.
+
+80
+00:02:54,000 --> 00:02:56,000
+So, we don't have to add an extra library.
+
+81
+00:02:56,000 --> 00:03:00,000
+Let's create the variable as encoder,
+
+82
+00:03:00,000 --> 00:03:02,000
+and then I can create the object like this.
+
+83
+00:03:02,000 --> 00:03:03,000
+This is one way.
+
+84
+00:03:03,000 --> 00:03:06,000
+Or, you can basically create a bean
+
+85
+00:03:06,000 --> 00:03:09,000
+inside your configuration in the security config,
+
+86
+00:03:09,000 --> 00:03:11,000
+return a bean of PasswordEncoder.
+
+87
+00:03:11,000 --> 00:03:13,000
+Again, you have a choice.
+
+88
+00:03:13,000 --> 00:03:15,000
+I'm just going for this variable thing here.
+
+89
+00:03:15,000 --> 00:03:18,000
+And then, in this, you can pass a strength.
+
+90
+00:03:18,000 --> 00:03:20,000
+So, how many rounds you want to go with.
+
+91
+00:03:20,000 --> 00:03:22,000
+So, we have done that 12 in the,
+
+92
+00:03:22,000 --> 00:03:23,000
+when we are generating your password,
+
+93
+00:03:23,000 --> 00:03:25,000
+I'll also go for 12 here.
+
+94
+00:03:25,000 --> 00:03:28,000
+We can also set different versions here if you want.
+
+95
+00:03:28,000 --> 00:03:30,000
+So, example, if I go back here,
+
+96
+00:03:30,000 --> 00:03:31,000
+and say Control+Space,
+
+97
+00:03:31,000 --> 00:03:34,000
+you can see we can specify the BCryptVersion
+
+98
+00:03:34,000 --> 00:03:35,000
+as $2A, $2B, $2Y.
+
+99
+00:03:36,000 --> 00:03:37,000
+These are the options you have,
+
+100
+00:03:37,000 --> 00:03:38,000
+but I don't want to specify that.
+
+101
+00:03:38,000 --> 00:03:40,000
+Let me go with default one, which is two 12A.
+
+102
+00:03:40,000 --> 00:03:42,000
+And you can see we got the strength.
+
+103
+00:03:42,000 --> 00:03:46,000
+And now, with this encoder, so I can say encoder dot,
+
+104
+00:03:46,000 --> 00:03:49,000
+I can basically encode a password, encode.
+
+105
+00:03:49,000 --> 00:03:51,000
+And what do you want to encode?
+
+106
+00:03:51,000 --> 00:03:54,000
+So, whatever user has, so user.getPassword,
+
+107
+00:03:54,000 --> 00:03:55,000
+that's what I'm encoding.
+
+108
+00:03:55,000 --> 00:03:57,000
+And then, assign it to back to the password.
+
+109
+00:03:57,000 --> 00:04:00,000
+And time being, let me also print
+
+110
+00:04:00,000 --> 00:04:02,000
+the new password which we assigned,
+
+111
+00:04:02,000 --> 00:04:04,000
+so that we can see in the console what the new password is.
+
+112
+00:04:04,000 --> 00:04:05,000
+Not a good idea in the production,
+
+113
+00:04:05,000 --> 00:04:08,000
+but since we're learning, we can see what is happening.
+
+114
+00:04:08,000 --> 00:04:10,000
+So now, when you register a new user,
+
+115
+00:04:10,000 --> 00:04:13,000
+it'll be registered with the help of this password, okay?
+
+116
+00:04:13,000 --> 00:04:15,000
+And, but there's one issue,
+
+117
+00:04:15,000 --> 00:04:17,000
+we have not implemented for reading,
+
+118
+00:04:17,000 --> 00:04:21,000
+so we'll still go with the same harsh and harsh@123
+
+119
+00:04:21,000 --> 00:04:22,000
+for verification.
+
+120
+00:04:22,000 --> 00:04:27,000
+So, let's go with harsh and h@123,
+
+121
+00:04:27,000 --> 00:04:32,000
+because we have not done the bcrypt encoder for retrieving
+
+122
+00:04:32,000 --> 00:04:34,000
+or to verify the user, okay?
+
+123
+00:04:34,000 --> 00:04:36,000
+Let's register a new user, which is this,
+
+124
+00:04:36,000 --> 00:04:39,000
+avni and a@123, that's a password.
+
+125
+00:04:39,000 --> 00:04:42,000
+I'll click on Send, and you can see it worked.
+
+126
+00:04:42,000 --> 00:04:44,000
+And this time, you can see we got a different password.
+
+127
+00:04:44,000 --> 00:04:46,000
+This is the encoded password.
+
+128
+00:04:46,000 --> 00:04:48,000
+Also, we can verify in the console
+
+129
+00:04:48,000 --> 00:04:49,000
+because we are printing it.
+
+130
+00:04:49,000 --> 00:04:51,000
+This is a new password.
+
+131
+00:04:51,000 --> 00:04:53,000
+Also, we can verify in database.
+
+132
+00:04:53,000 --> 00:04:55,000
+And I will just hit this particular query here.
+
+133
+00:04:55,000 --> 00:04:57,000
+So, we've got a new user with this password.
+
+134
+00:04:57,000 --> 00:04:59,000
+Now, this is the encoded password.
+
+135
+00:04:59,000 --> 00:05:02,000
+Of course, while sending it, you have sent a@123,
+
+136
+00:05:02,000 --> 00:05:05,000
+but we got encoded format here.
+
+137
+00:05:05,000 --> 00:05:08,000
+But now, let's implement this for retrieving.
+
+138
+00:05:08,000 --> 00:05:09,000
+So, what we have done is,
+
+139
+00:05:09,000 --> 00:05:13,000
+we used bcrypt for storing up a new user
+
+140
+00:05:13,000 --> 00:05:16,000
+or grasping a new user, right?
+
+141
+00:05:16,000 --> 00:05:19,000
+But how do I verify this for the authentication?
+
+142
+00:05:19,000 --> 00:05:21,000
+Let's try that in the next video.
+

20 - Spring Security/026 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.26%20Bcrypt%20Encoding%20For%20User%20Registration/spring-sec-demo

20 - Spring Security/027 Setting Password Encoder_en.srt

@@ -0,0 +1,312 @@
+1
+00:00:00,000 --> 00:00:03,000
+(peaceful music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: And now let's do it for the authentication.
+
+3
+00:00:05,000 --> 00:00:07,000
+So basically the registration done
+
+4
+00:00:07,000 --> 00:00:10,000
+and we also got a password in the incorrect format.
+
+5
+00:00:10,000 --> 00:00:12,000
+And you can see even if someone hacks the database
+
+6
+00:00:12,000 --> 00:00:14,000
+for this two records, at least,
+
+7
+00:00:14,000 --> 00:00:15,000
+they can't see the passwords.
+
+8
+00:00:15,000 --> 00:00:17,000
+Here we can, but that's what we have done before.
+
+9
+00:00:17,000 --> 00:00:21,000
+But now I want to authenticate right?
+
+10
+00:00:21,000 --> 00:00:23,000
+Now you'll be thinking we have to get multiple classes,
+
+11
+00:00:23,000 --> 00:00:25,000
+multiple files, not exactly.
+
+12
+00:00:25,000 --> 00:00:29,000
+If you go back to your security config, remember this line,
+
+13
+00:00:29,000 --> 00:00:32,000
+this line is the only thing we have to change.
+
+14
+00:00:32,000 --> 00:00:34,000
+Everything else remains same.
+
+15
+00:00:34,000 --> 00:00:35,000
+Let me show you how.
+
+16
+00:00:35,000 --> 00:00:36,000
+Now when you say set password encode,
+
+17
+00:00:36,000 --> 00:00:38,000
+remember when we talked about
+
+18
+00:00:38,000 --> 00:00:39,000
+authentication provider,
+
+19
+00:00:39,000 --> 00:00:42,000
+which was using a DAO authentication provider,
+
+20
+00:00:42,000 --> 00:00:44,000
+and we have set the password encoder
+
+21
+00:00:44,000 --> 00:00:45,000
+as no OP password encoder,
+
+22
+00:00:45,000 --> 00:00:47,000
+and that's why it was checking with a plain text.
+
+23
+00:00:47,000 --> 00:00:50,000
+Now let's replace this with our library.
+
+24
+00:00:50,000 --> 00:00:55,000
+So we'll simply say new Bcrypt password encoder
+
+25
+00:00:55,000 --> 00:00:58,000
+and just say 12, done.
+
+26
+00:00:58,000 --> 00:01:00,000
+That's the only change which which have to do
+
+27
+00:01:00,000 --> 00:01:01,000
+for the authentication
+
+28
+00:01:01,000 --> 00:01:03,000
+because other things we have already done,
+
+29
+00:01:03,000 --> 00:01:05,000
+right, now will this work, let's try.
+
+30
+00:01:05,000 --> 00:01:07,000
+Now, the way I can try
+
+31
+00:01:07,000 --> 00:01:08,000
+that is let me restart the application first
+
+32
+00:01:08,000 --> 00:01:13,000
+and let's try with the new account, which is Omni, right?
+
+33
+00:01:13,000 --> 00:01:15,000
+So let me go back to my postman
+
+34
+00:01:15,000 --> 00:01:18,000
+and let's hit the query for the hello, right?
+
+35
+00:01:18,000 --> 00:01:19,000
+So let's try to send hello.
+
+36
+00:01:19,000 --> 00:01:21,000
+And this time I will set the code,
+
+37
+00:01:21,000 --> 00:01:23,000
+one, two, three, four, send.
+
+38
+00:01:23,000 --> 00:01:24,000
+Of course you will get error
+
+39
+00:01:24,000 --> 00:01:25,000
+because we don't have this user.
+
+40
+00:01:25,000 --> 00:01:29,000
+And now I will try with something which is in plain text,
+
+41
+00:01:29,000 --> 00:01:32,000
+which is Hirsch and Hirsch at the rate one, two, three.
+
+42
+00:01:32,000 --> 00:01:36,000
+So it's a Hirsch and H at the data one, two, three.
+
+43
+00:01:36,000 --> 00:01:39,000
+Click on send. Even this is not working.
+
+44
+00:01:39,000 --> 00:01:41,000
+We do have this user, it's not working,
+
+45
+00:01:41,000 --> 00:01:44,000
+because we are searching for a plain text.
+
+46
+00:01:44,000 --> 00:01:45,000
+And in the coding we have said
+
+47
+00:01:45,000 --> 00:01:47,000
+that you have to use a Bcrypt.
+
+48
+00:01:47,000 --> 00:01:50,000
+And in the database it's not Bcrypt, it's a plain text.
+
+49
+00:01:50,000 --> 00:01:53,000
+So now I will go with Avni because it's already Bcrypt.
+
+50
+00:01:53,000 --> 00:01:58,000
+So I will say A at the rate one, two, three, run, it worked.
+
+51
+00:01:59,000 --> 00:02:00,000
+You can see that?
+
+52
+00:02:00,000 --> 00:02:02,000
+So this is how basically we can implement
+
+53
+00:02:02,000 --> 00:02:05,000
+Bcrypt for password encoding.
+
+54
+00:02:05,000 --> 00:02:07,000
+So you these two users you can delete now.
+
+55
+00:02:07,000 --> 00:02:09,000
+You can only focus on this two Navin and Avni,
+
+56
+00:02:09,000 --> 00:02:12,000
+and that's the passwords which are in encrypted format.
+
+57
+00:02:12,000 --> 00:02:15,000
+So it's so easy to implement a password encoder
+
+58
+00:02:15,000 --> 00:02:18,000
+to secure your database, not database,
+
+59
+00:02:18,000 --> 00:02:19,000
+but then the password fields.
+
+60
+00:02:19,000 --> 00:02:23,000
+So that's it from this video where we talked about Bcrypt.
+
+61
+00:02:23,000 --> 00:02:24,000
+How do we implement this?
+
+62
+00:02:24,000 --> 00:02:28,000
+So just to give you a overall picture for registration,
+
+63
+00:02:28,000 --> 00:02:30,000
+this particular controller has no idea
+
+64
+00:02:30,000 --> 00:02:31,000
+that we have to do encoding.
+
+65
+00:02:31,000 --> 00:02:34,000
+The actual encoding is happening in the user service,
+
+66
+00:02:34,000 --> 00:02:35,000
+which is service layer,
+
+67
+00:02:35,000 --> 00:02:38,000
+and whatever user you're getting from the controller,
+
+68
+00:02:38,000 --> 00:02:40,000
+you are basically encoding the password,
+
+69
+00:02:40,000 --> 00:02:42,000
+then you are saving the user,
+
+70
+00:02:42,000 --> 00:02:43,000
+and then when you are authenticating,
+
+71
+00:02:43,000 --> 00:02:47,000
+basically here we have used a password encoder,
+
+72
+00:02:47,000 --> 00:02:49,000
+set password encoder with Bcrypt,
+
+73
+00:02:49,000 --> 00:02:50,000
+you have to make sure that you use the same strength,
+
+74
+00:02:50,000 --> 00:02:51,000
+otherwise it'll not work.
+
+75
+00:02:51,000 --> 00:02:52,000
+If you specify 10 here,
+
+76
+00:02:52,000 --> 00:02:56,000
+if you specify 12 in the creation, this will not work.
+
+77
+00:02:56,000 --> 00:02:59,000
+So you have to make sure that you specify the same strength.
+
+78
+00:02:59,000 --> 00:03:02,000
+So that's it from this video. See you in the next topic.
+

20 - Spring Security/027 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.27%20Setting%20Password%20Encoder/spring-sec-demo

20 - Spring Security/external-links.txt

@@ -0,0 +1,54 @@
+
+003 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.3%20Creating%20A%20Spring%20Security%20Project/spring-sec-demo
+
+004 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.4%20Default%20Login%20Form/spring-sec-demo
+
+006 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.6%20Session%20Id/spring-sec-demo
+
+007 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.7%20Setting%20Username%20And%20Password/spring-sec-demo4
+
+010 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.10%20Error%20Without%20Csrf%20Token/spring-sec-demo
+
+011 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.11%20Sending%20Csrf%20Token/spring-sec-demo
+
+013 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.13%20Security%20Configuration/spring-sec-demo
+
+014 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.14%20Disabling%20Csrf%20Token/spring-sec-demo
+
+015 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/86a7c9e9036f7665f50c28c243fed20247f180d7/12%20Spring%20security/12.15%20Without%20Lambda/spring-sec-demo
+
+017 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.17%20Working%20With%20Multiple%20Users/spring-sec-demo
+
+018 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.18%20Creating%20User%20Table%20And%20Db%20Properties/spring-sec-demo
+
+019 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.19%20Authenticationprovider/spring-sec-demo
+
+020 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.20%20Creating%20A%20Userdetailsservice/spring-sec-demo
+
+021 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.21%20User%20Repository/spring-sec-demo
+
+022 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.22%20Userdetails%20And%20Userprincipal/spring-sec-demo
+
+025 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.25%20User%20Registration/spring-sec-demo
+
+026 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.26%20Bcrypt%20Encoding%20For%20User%20Registration/spring-sec-demo
+
+027 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/12.27%20Setting%20Password%20Encoder/spring-sec-demo

21 - Securing Job App/001 Plan to secure Job App Project_en.srt

@@ -0,0 +1,444 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:06,000
+-: Now it's time to secure our job application.
+
+3
+00:00:06,000 --> 00:00:08,000
+So to this point, basically we have worked
+
+4
+00:00:08,000 --> 00:00:09,000
+with a separate project
+
+5
+00:00:09,000 --> 00:00:10,000
+and you can see we have project name,
+
+6
+00:00:10,000 --> 00:00:13,000
+which is spring-security-demo,
+
+7
+00:00:13,000 --> 00:00:16,000
+in which basically we had two controllers,
+
+8
+00:00:16,000 --> 00:00:17,000
+one for the HelloController,
+
+9
+00:00:17,000 --> 00:00:21,000
+where we were simply printing returning Hello World,
+
+10
+00:00:21,000 --> 00:00:24,000
+and then we also have a string controller.
+
+11
+00:00:24,000 --> 00:00:26,000
+And then we tried to secure this application
+
+12
+00:00:26,000 --> 00:00:29,000
+with the help of Spring Security.
+
+13
+00:00:29,000 --> 00:00:31,000
+And for that, we have basically created
+
+14
+00:00:31,000 --> 00:00:33,000
+multiple classes, multiple interfaces.
+
+15
+00:00:33,000 --> 00:00:36,000
+Example, we got this interface which use repo,
+
+16
+00:00:36,000 --> 00:00:37,000
+which connects with the database.
+
+17
+00:00:37,000 --> 00:00:38,000
+So if you can see,
+
+18
+00:00:38,000 --> 00:00:40,000
+we also have our database here, which is this.
+
+19
+00:00:40,000 --> 00:00:43,000
+And in this, what we are doing is basically we have a table
+
+20
+00:00:43,000 --> 00:00:47,000
+called users in which you got three columns
+
+21
+00:00:47,000 --> 00:00:49,000
+and then out of this we have four records
+
+22
+00:00:49,000 --> 00:00:52,000
+in which two records are vacated,
+
+23
+00:00:52,000 --> 00:00:54,000
+and of course we are going to use this one,
+
+24
+00:00:54,000 --> 00:00:56,000
+not the other two because they're plain text,
+
+25
+00:00:56,000 --> 00:00:57,000
+it will not even work.
+
+26
+00:00:57,000 --> 00:01:00,000
+And now, apart from this, we also have a class
+
+27
+00:01:00,000 --> 00:01:02,000
+for the user to represent user,
+
+28
+00:01:02,000 --> 00:01:04,000
+and then we got user principle,
+
+29
+00:01:04,000 --> 00:01:06,000
+which deals with user details,
+
+30
+00:01:06,000 --> 00:01:08,000
+and then we got two classes for service.
+
+31
+00:01:08,000 --> 00:01:12,000
+Actually, we can add this part inside this service itself.
+
+32
+00:01:12,000 --> 00:01:16,000
+So you don't have to have two different classes.
+
+33
+00:01:16,000 --> 00:01:19,000
+We can basically copy this class, this method here,
+
+34
+00:01:19,000 --> 00:01:22,000
+and paste it in the user details, even that will work.
+
+35
+00:01:22,000 --> 00:01:26,000
+So, but then we have those two classes just to differentiate
+
+36
+00:01:26,000 --> 00:01:28,000
+what is compulsory and what we are doing
+
+37
+00:01:28,000 --> 00:01:30,000
+for the user service.
+
+38
+00:01:30,000 --> 00:01:32,000
+And we have done something,
+
+39
+00:01:32,000 --> 00:01:33,000
+some changes in the application properties.
+
+40
+00:01:33,000 --> 00:01:35,000
+We have a database connectivity.
+
+41
+00:01:35,000 --> 00:01:36,000
+I think it'll be same there.
+
+42
+00:01:36,000 --> 00:01:38,000
+And then to secure, we have to use
+
+43
+00:01:38,000 --> 00:01:41,000
+this particular dependency, which is Spring Security.
+
+44
+00:01:41,000 --> 00:01:43,000
+Now we need to implement this in the job portal.
+
+45
+00:01:43,000 --> 00:01:46,000
+Now if you go back to job portal, which we have done,
+
+46
+00:01:46,000 --> 00:01:47,000
+now, if you want to get this project,
+
+47
+00:01:47,000 --> 00:01:51,000
+this is from our lecture name Search by Keyword
+
+48
+00:01:51,000 --> 00:01:52,000
+from data JPA.
+
+49
+00:01:52,000 --> 00:01:54,000
+This is the project which we're going to change,
+
+50
+00:01:54,000 --> 00:01:57,000
+and this project works, but it is not secure.
+
+51
+00:01:57,000 --> 00:01:58,000
+Let me show you.
+
+52
+00:01:58,000 --> 00:01:58,000
+What I will do is, first of all,
+
+53
+00:01:58,000 --> 00:02:01,000
+I have to make sure that I'm not running the earlier one
+
+54
+00:02:01,000 --> 00:02:03,000
+because I want to use the same code number.
+
+55
+00:02:03,000 --> 00:02:06,000
+Let me run this, the project, which we have done way back,
+
+56
+00:02:06,000 --> 00:02:08,000
+and this should work, so let me run this.
+
+57
+00:02:08,000 --> 00:02:09,000
+So this job portal,
+
+58
+00:02:09,000 --> 00:02:12,000
+which is not secure at this point, I'm running it.
+
+59
+00:02:12,000 --> 00:02:17,000
+Let me go back to Postman and hit the URL for job portal.
+
+60
+00:02:17,000 --> 00:02:18,000
+So if you go back,
+
+61
+00:02:18,000 --> 00:02:20,000
+this is the job portal which we had, right,
+
+62
+00:02:20,000 --> 00:02:22,000
+so let me just pick up this.
+
+63
+00:02:22,000 --> 00:02:23,000
+So you can see this is a (indistinct),
+
+64
+00:02:23,000 --> 00:02:26,000
+localhost:8080/jobPost
+
+65
+00:02:26,000 --> 00:02:29,000
+and I know you might be watching this bit later
+
+66
+00:02:29,000 --> 00:02:32,000
+so I just want to show you the end points.
+
+67
+00:02:32,000 --> 00:02:34,000
+So if I go back to Job Rest Controller,
+
+68
+00:02:34,000 --> 00:02:37,000
+you can see we have a Git mapping for jobPost,
+
+69
+00:02:37,000 --> 00:02:38,000
+which will return all the posts.
+
+70
+00:02:38,000 --> 00:02:40,000
+From where we are getting this data,
+
+71
+00:02:40,000 --> 00:02:43,000
+if you'll see the table, we do have this job post table,
+
+72
+00:02:43,000 --> 00:02:45,000
+which if I say view all rows,
+
+73
+00:02:45,000 --> 00:02:47,000
+this is basically a job portal.
+
+74
+00:02:47,000 --> 00:02:49,000
+We only have two jobs, but that's fine.
+
+75
+00:02:49,000 --> 00:02:51,000
+We just want to secure whatever resource we have.
+
+76
+00:02:51,000 --> 00:02:54,000
+I want to secure this and the way you can do that
+
+77
+00:02:54,000 --> 00:02:55,000
+is by adding Spring Security,
+
+78
+00:02:55,000 --> 00:02:59,000
+but since we have not added them, let me send the request.
+
+79
+00:02:59,000 --> 00:03:01,000
+Of course, I have to say no auth
+
+80
+00:03:01,000 --> 00:03:03,000
+in the headers, nothing specified.
+
+81
+00:03:03,000 --> 00:03:05,000
+If I go back to no auth,
+
+82
+00:03:05,000 --> 00:03:07,000
+click on send and look at the response.
+
+83
+00:03:07,000 --> 00:03:10,000
+We got this data and this is not secured yet.
+
+84
+00:03:10,000 --> 00:03:12,000
+Now let's secure this.
+
+85
+00:03:12,000 --> 00:03:13,000
+So what are the things we have to do?
+
+86
+00:03:13,000 --> 00:03:14,000
+Of course, if you want to secure this,
+
+87
+00:03:14,000 --> 00:03:17,000
+the first thing you will do in this project
+
+88
+00:03:17,000 --> 00:03:19,000
+is you will go to your POM file
+
+89
+00:03:19,000 --> 00:03:21,000
+and add this Spring Security dependency, that's one.
+
+90
+00:03:21,000 --> 00:03:24,000
+Next, we have to config the security
+
+91
+00:03:24,000 --> 00:03:26,000
+because now we want to use a table
+
+92
+00:03:26,000 --> 00:03:29,000
+where you have your users and we already have a table
+
+93
+00:03:29,000 --> 00:03:31,000
+so we don't have to create one, we just have to map it,
+
+94
+00:03:31,000 --> 00:03:33,000
+and that's why our job will become easy now,
+
+95
+00:03:33,000 --> 00:03:34,000
+because we are already done a lot of things
+
+96
+00:03:34,000 --> 00:03:37,000
+in the earlier project, we can just use them here.
+
+97
+00:03:37,000 --> 00:03:38,000
+So if we have to do the configuration,
+
+98
+00:03:38,000 --> 00:03:41,000
+we have to create classes for the users,
+
+99
+00:03:41,000 --> 00:03:43,000
+class for the user detail service,
+
+100
+00:03:43,000 --> 00:03:46,000
+and then a repo, user repo interface.
+
+101
+00:03:46,000 --> 00:03:49,000
+So all these things will be added in this project,
+
+102
+00:03:49,000 --> 00:03:51,000
+and we'll do step by step.
+
+103
+00:03:51,000 --> 00:03:52,000
+I'm not going to code everything
+
+104
+00:03:52,000 --> 00:03:53,000
+because we already done that,
+
+105
+00:03:53,000 --> 00:03:54,000
+I can just use them in this project.
+
+106
+00:03:54,000 --> 00:03:56,000
+But we have one more thing
+
+107
+00:03:56,000 --> 00:03:58,000
+which we have not talked about in the previous project,
+
+108
+00:03:58,000 --> 00:04:00,000
+and that is your cross origin.
+
+109
+00:04:00,000 --> 00:04:02,000
+So in the next video, let's try to understand
+
+110
+00:04:02,000 --> 00:04:04,000
+what is cross origin and then we'll move towards
+
+111
+00:04:04,000 --> 00:04:05,000
+securing this application.
+

21 - Securing Job App/001 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.1%20Plan%20To%20Secure%20Job%20App%20Project/spring-boot-rest

21 - Securing Job App/002 Cross Origin_en.srt

@@ -0,0 +1,236 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:07,000
+-: Now let's talk about this CrossOrigin, also called Cross.
+
+3
+00:00:07,000 --> 00:00:08,000
+So basically, what is happening here
+
+4
+00:00:08,000 --> 00:00:09,000
+is we have two different projects.
+
+5
+00:00:09,000 --> 00:00:12,000
+One for the front end and one for the back end.
+
+6
+00:00:12,000 --> 00:00:14,000
+We have built our front end using React,
+
+7
+00:00:14,000 --> 00:00:17,000
+and we have built our back end with Spring.
+
+8
+00:00:17,000 --> 00:00:19,000
+Now the back end, which is Spring,
+
+9
+00:00:19,000 --> 00:00:22,000
+we are running on a port number 8080,
+
+10
+00:00:22,000 --> 00:00:24,000
+which is localhost:8080.
+
+11
+00:00:24,000 --> 00:00:26,000
+And then the front end, which is your React application,
+
+12
+00:00:26,000 --> 00:00:28,000
+is running on a different port number, which is 3000.
+
+13
+00:00:28,000 --> 00:00:32,000
+Now by default, Spring says you can't actually access
+
+14
+00:00:32,000 --> 00:00:33,000
+a resource from a different origin
+
+15
+00:00:33,000 --> 00:00:35,000
+because we have a different port number there.
+
+16
+00:00:35,000 --> 00:00:37,000
+So it'll stop it. And why is important is because
+
+17
+00:00:37,000 --> 00:00:40,000
+what if someone else is trying to access your resource
+
+18
+00:00:40,000 --> 00:00:42,000
+from a different origin?
+
+19
+00:00:42,000 --> 00:00:43,000
+And that's a risky part, right?
+
+20
+00:00:43,000 --> 00:00:45,000
+So that's not security.
+
+21
+00:00:45,000 --> 00:00:46,000
+So if you want to make it more secure
+
+22
+00:00:46,000 --> 00:00:47,000
+by default, Spring says,
+
+23
+00:00:47,000 --> 00:00:50,000
+hey, you're not allowed to directly access a resource
+
+24
+00:00:50,000 --> 00:00:52,000
+from the outside origin.
+
+25
+00:00:52,000 --> 00:00:53,000
+And if you want to allow it,
+
+26
+00:00:53,000 --> 00:00:55,000
+of course we have to allow it in our application
+
+27
+00:00:55,000 --> 00:00:57,000
+because we are running on two different ports
+
+28
+00:00:57,000 --> 00:00:58,000
+or two different origins.
+
+29
+00:00:58,000 --> 00:01:01,000
+And to do that, we are using CrossOrigin
+
+30
+00:01:01,000 --> 00:01:03,000
+and we are specifying that from where
+
+31
+00:01:03,000 --> 00:01:05,000
+you will be getting this request.
+
+32
+00:01:05,000 --> 00:01:08,000
+So we are getting this request from localhost:3000.
+
+33
+00:01:08,000 --> 00:01:10,000
+Of course, once you deploy, you will get a different URL.
+
+34
+00:01:10,000 --> 00:01:12,000
+So you will allow it for that.
+
+35
+00:01:12,000 --> 00:01:14,000
+So you will say, okay, whenever you get requests from this,
+
+36
+00:01:14,000 --> 00:01:15,000
+you have to allow it.
+
+37
+00:01:15,000 --> 00:01:17,000
+And sometime maybe you want your APIs
+
+38
+00:01:17,000 --> 00:01:18,000
+to be public for the user.
+
+39
+00:01:18,000 --> 00:01:21,000
+In that case you have to simply say CrossOrigin,
+
+40
+00:01:21,000 --> 00:01:23,000
+then it will allow for all the request.
+
+41
+00:01:23,000 --> 00:01:25,000
+Okay, you can do that on each controller
+
+42
+00:01:25,000 --> 00:01:27,000
+the way I'm doing here.
+
+43
+00:01:27,000 --> 00:01:30,000
+Or you can do a configuration in the config file
+
+44
+00:01:30,000 --> 00:01:32,000
+to allow from everywhere.
+
+45
+00:01:32,000 --> 00:01:35,000
+At this point, I'm not doing it, but that's the idea.
+
+46
+00:01:35,000 --> 00:01:37,000
+So CrossOrigin simply means that if you are accessing
+
+47
+00:01:37,000 --> 00:01:39,000
+the data from the outside world
+
+48
+00:01:39,000 --> 00:01:41,000
+from this particular application,
+
+49
+00:01:41,000 --> 00:01:42,000
+then it'll by default blocked.
+
+50
+00:01:42,000 --> 00:01:46,000
+And if you want to allow it, you have to say CrossOrigin.
+
+51
+00:01:46,000 --> 00:01:49,000
+And also cause is basically one of these issues
+
+52
+00:01:49,000 --> 00:01:52,000
+in the OS top 10, which we have discussed.
+
+53
+00:01:52,000 --> 00:01:55,000
+And that's how basically, Spring takes care of it.
+
+54
+00:01:55,000 --> 00:01:56,000
+But yeah, we have used it by default.
+
+55
+00:01:56,000 --> 00:01:58,000
+I have not explained to you when we were doing this
+
+56
+00:01:58,000 --> 00:02:01,000
+or maybe you have done that, but not in terms of security.
+
+57
+00:02:01,000 --> 00:02:03,000
+But yes, you have to allow it from the outside world.
+
+58
+00:02:03,000 --> 00:02:05,000
+And if you don't do that, it will not allow.
+
+59
+00:02:05,000 --> 00:02:07,000
+Okay, so that's your CrossOrigin.
+

21 - Securing Job App/003 Adding Security Configuration_en.srt

@@ -0,0 +1,336 @@
+1
+00:00:00,000 --> 00:00:03,000
+(pleasant, soft music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: And now, once we have talked about CrossOrigin,
+
+3
+00:00:05,000 --> 00:00:06,000
+it's time to secure it.
+
+4
+00:00:06,000 --> 00:00:09,000
+Now, in this project, we have less number of files,
+
+5
+00:00:09,000 --> 00:00:11,000
+but we'll add more for the security,
+
+6
+00:00:11,000 --> 00:00:13,000
+and we'll take it from our older project.
+
+7
+00:00:13,000 --> 00:00:14,000
+So, let me go back to my older project,
+
+8
+00:00:14,000 --> 00:00:16,000
+which is your spring security demo.
+
+9
+00:00:16,000 --> 00:00:19,000
+The first thing you will do is you will add spring security.
+
+10
+00:00:19,000 --> 00:00:22,000
+So I will just copy this dependency block here
+
+11
+00:00:22,000 --> 00:00:25,000
+from the XML file and go back to our project.
+
+12
+00:00:25,000 --> 00:00:27,000
+Let's open the XML for this particular project,
+
+13
+00:00:27,000 --> 00:00:30,000
+and now, let's add the dependency.
+
+14
+00:00:30,000 --> 00:00:32,000
+I will just do it above Lombok,
+
+15
+00:00:32,000 --> 00:00:35,000
+and now you can see I have added the spring security
+
+16
+00:00:35,000 --> 00:00:36,000
+dependency of Spring Boot.
+
+17
+00:00:36,000 --> 00:00:38,000
+Now once you add that in your project, you have
+
+18
+00:00:38,000 --> 00:00:40,000
+to reload your VIN for the changes
+
+19
+00:00:40,000 --> 00:00:43,000
+and you can say it says resolving dependency done.
+
+20
+00:00:43,000 --> 00:00:45,000
+Now, how do I verify if this is secure?
+
+21
+00:00:45,000 --> 00:00:46,000
+I have to restart the application
+
+22
+00:00:46,000 --> 00:00:48,000
+because we have changed the palm file.
+
+23
+00:00:48,000 --> 00:00:51,000
+Okay, so you can see we got this project running.
+
+24
+00:00:51,000 --> 00:00:53,000
+Let me go back to my postman
+
+25
+00:00:53,000 --> 00:00:55,000
+and let's try to hit the same U model.
+
+26
+00:00:55,000 --> 00:00:57,000
+The moment you add spring security,
+
+27
+00:00:57,000 --> 00:00:59,000
+and when you say send, it'll not work
+
+28
+00:00:59,000 --> 00:01:03,000
+because now your application is kind of secure.
+
+29
+00:01:03,000 --> 00:01:06,000
+So if you want to make it work, you have to say basic auth
+
+30
+00:01:06,000 --> 00:01:08,000
+and you have to specify the user.
+
+31
+00:01:08,000 --> 00:01:10,000
+Now, this username password will not work.
+
+32
+00:01:10,000 --> 00:01:12,000
+It's because we have not connected with database yet.
+
+33
+00:01:12,000 --> 00:01:14,000
+So even if you try with that, this will not work.
+
+34
+00:01:14,000 --> 00:01:16,000
+You can say we got 4 0 1.
+
+35
+00:01:16,000 --> 00:01:20,000
+So we have to use a default username, which is user
+
+36
+00:01:20,000 --> 00:01:21,000
+and the default password,
+
+37
+00:01:21,000 --> 00:01:24,000
+which you'll be getting in the console.
+
+38
+00:01:24,000 --> 00:01:26,000
+So if you go back to console here, not this project.
+
+39
+00:01:26,000 --> 00:01:28,000
+If you go back to console here,
+
+40
+00:01:28,000 --> 00:01:30,000
+and if you go up, you got a password.
+
+41
+00:01:30,000 --> 00:01:33,000
+And we have done this before, so we can just copy that
+
+42
+00:01:33,000 --> 00:01:37,000
+and paste it here and click on send, it worked.
+
+43
+00:01:37,000 --> 00:01:40,000
+So basically now it's kind of secured.
+
+44
+00:01:40,000 --> 00:01:41,000
+Now when I say kind of secure,
+
+45
+00:01:41,000 --> 00:01:43,000
+it's because you are generating a password
+
+46
+00:01:43,000 --> 00:01:46,000
+in the application, which is same for all the users.
+
+47
+00:01:46,000 --> 00:01:49,000
+Not exactly security, but yeah, we got something, right?
+
+48
+00:01:49,000 --> 00:01:50,000
+This is partially secured now.
+
+49
+00:01:50,000 --> 00:01:52,000
+Next, what's the next step?
+
+50
+00:01:52,000 --> 00:01:53,000
+We need to copy files.
+
+51
+00:01:53,000 --> 00:01:56,000
+I have to, I want to change the configuration.
+
+52
+00:01:56,000 --> 00:01:58,000
+So when you say you want to change the configuration from
+
+53
+00:01:58,000 --> 00:02:01,000
+your older project, we need to get the config file.
+
+54
+00:02:01,000 --> 00:02:03,000
+This one, in the config package.
+
+55
+00:02:03,000 --> 00:02:06,000
+So I'll just copy this, the secure config,
+
+56
+00:02:06,000 --> 00:02:07,000
+go back to my old project.
+
+57
+00:02:07,000 --> 00:02:11,000
+We don't have a config folder here in the job application.
+
+58
+00:02:11,000 --> 00:02:14,000
+So I will create a package for config.
+
+59
+00:02:14,000 --> 00:02:16,000
+And here, let's paste it.
+
+60
+00:02:16,000 --> 00:02:18,000
+So this particular file will be pasted,
+
+61
+00:02:18,000 --> 00:02:20,000
+of course this will not work,
+
+62
+00:02:20,000 --> 00:02:23,000
+is because we don't have these classes created yet.
+
+63
+00:02:23,000 --> 00:02:24,000
+But let me just try
+
+64
+00:02:24,000 --> 00:02:28,000
+to see if all the packages are imported.
+
+65
+00:02:28,000 --> 00:02:30,000
+We are saying that we want to go with user details,
+
+66
+00:02:30,000 --> 00:02:32,000
+but it'll pick up the inbuilt,
+
+67
+00:02:32,000 --> 00:02:35,000
+not the one which we created, but let's try.
+
+68
+00:02:35,000 --> 00:02:37,000
+Let's try, let's see what error you get.
+
+69
+00:02:37,000 --> 00:02:39,000
+Even we are using B crypt here.
+
+70
+00:02:39,000 --> 00:02:42,000
+So let me just try, if this works,
+
+71
+00:02:42,000 --> 00:02:43,000
+let me just start the application
+
+72
+00:02:43,000 --> 00:02:47,000
+and go back to our postman just by adding that config file
+
+73
+00:02:47,000 --> 00:02:50,000
+and I will click on send.
+
+74
+00:02:52,000 --> 00:02:55,000
+Okay, so it looks like we got error here.
+
+75
+00:02:55,000 --> 00:03:00,000
+It says the field user detail service is a bean,
+
+76
+00:03:00,000 --> 00:03:01,000
+but could not be found
+
+77
+00:03:01,000 --> 00:03:03,000
+because we have not created the class for it.
+
+78
+00:03:03,000 --> 00:03:06,000
+So let's try to add the classes for user details.
+
+79
+00:03:06,000 --> 00:03:07,000
+So next video we'll be bit lengthy
+
+80
+00:03:07,000 --> 00:03:09,000
+because we'll be adding all the files,
+
+81
+00:03:09,000 --> 00:03:10,000
+but we got the idea, right?
+
+82
+00:03:10,000 --> 00:03:13,000
+So we cannot simply add a security config,
+
+83
+00:03:13,000 --> 00:03:15,000
+we have to add other files as well.
+
+84
+00:03:15,000 --> 00:03:18,000
+So let's do that step by step in the next video.
+

21 - Securing Job App/003 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.3%20Adding%20Security%20Configuration/spring-boot-rest

21 - Securing Job App/004 Job App is secure now_en.srt

@@ -0,0 +1,652 @@
+1
+00:00:00,000 --> 00:00:03,000
+(calm music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: And now let's copy those files.
+
+3
+00:00:05,000 --> 00:00:06,000
+So I will just go back to my project,
+
+4
+00:00:06,000 --> 00:00:08,000
+which we have done before for the security.
+
+5
+00:00:08,000 --> 00:00:09,000
+Now what are the files we need?
+
+6
+00:00:09,000 --> 00:00:10,000
+So we copied config,
+
+7
+00:00:10,000 --> 00:00:15,000
+SecurityConfig, but now we need to get this UserDetails.
+
+8
+00:00:15,000 --> 00:00:17,000
+So I will copy both the service classes,
+
+9
+00:00:17,000 --> 00:00:19,000
+UserDetails for the configuration
+
+10
+00:00:19,000 --> 00:00:22,000
+and UserService for your registration.
+
+11
+00:00:22,000 --> 00:00:24,000
+So we'll just copy these two files.
+
+12
+00:00:24,000 --> 00:00:25,000
+Go back to my project.
+
+13
+00:00:25,000 --> 00:00:27,000
+In the service package,
+
+14
+00:00:27,000 --> 00:00:28,000
+let's paste it, both the files.
+
+15
+00:00:28,000 --> 00:00:30,000
+And when you open the UserService,
+
+16
+00:00:30,000 --> 00:00:32,000
+of course it will give you some issues
+
+17
+00:00:32,000 --> 00:00:35,000
+that you don't have this particular UserRepo.
+
+18
+00:00:35,000 --> 00:00:36,000
+Let me remove the imports
+
+19
+00:00:36,000 --> 00:00:38,000
+because we have a different package name.
+
+20
+00:00:38,000 --> 00:00:40,000
+It'll create issues. And now we need to get the UserRepo.
+
+21
+00:00:40,000 --> 00:00:42,000
+We need to get the User, and that's it.
+
+22
+00:00:42,000 --> 00:00:44,000
+So we have to get these two files.
+
+23
+00:00:44,000 --> 00:00:46,000
+Also, if you open your UserDetailsService,
+
+24
+00:00:46,000 --> 00:00:50,000
+even this is dependent on the User and the UserRepo.
+
+25
+00:00:50,000 --> 00:00:52,000
+So we have to remove the invite packages.
+
+26
+00:00:52,000 --> 00:00:55,000
+So ultimately we are dependent upon two files now,
+
+27
+00:00:55,000 --> 00:00:58,000
+UserRepo and the User file, or User class.
+
+28
+00:00:58,000 --> 00:01:01,000
+So let me go back here. So it needs a user.
+
+29
+00:01:01,000 --> 00:01:04,000
+So we'll copy User, paste it in the model package.
+
+30
+00:01:04,000 --> 00:01:05,000
+Done.
+
+31
+00:01:05,000 --> 00:01:07,000
+Okay, so we got the User
+
+32
+00:01:07,000 --> 00:01:09,000
+and all the imports looks good.
+
+33
+00:01:09,000 --> 00:01:10,000
+Let me go back to my UserDetailsService.
+
+34
+00:01:10,000 --> 00:01:12,000
+Now we are able to get the user,
+
+35
+00:01:12,000 --> 00:01:14,000
+you can see there's no problem.
+
+36
+00:01:14,000 --> 00:01:15,000
+We can simply import it.
+
+37
+00:01:15,000 --> 00:01:18,000
+And for the UserService also
+
+38
+00:01:18,000 --> 00:01:20,000
+the User is resolved.
+
+39
+00:01:20,000 --> 00:01:22,000
+But then repo. Where's repo?
+
+40
+00:01:22,000 --> 00:01:24,000
+Let me go back to my older project
+
+41
+00:01:24,000 --> 00:01:28,000
+and get the UserRepo, which should be in dao.
+
+42
+00:01:28,000 --> 00:01:30,000
+So you can see we already have a repo layer.
+
+43
+00:01:30,000 --> 00:01:31,000
+So this time we are not using dao layer.
+
+44
+00:01:31,000 --> 00:01:33,000
+Here we have a repo layer, but that's fine.
+
+45
+00:01:33,000 --> 00:01:35,000
+The concept remains same.
+
+46
+00:01:35,000 --> 00:01:37,000
+Let me remove both this dependency
+
+47
+00:01:37,000 --> 00:01:41,000
+and say get the User from this
+
+48
+00:01:41,000 --> 00:01:45,000
+and also the JpaRepository, done.
+
+49
+00:01:45,000 --> 00:01:47,000
+And you can see there's no problem with repo now.
+
+50
+00:01:47,000 --> 00:01:49,000
+In the service, it should be happy
+
+51
+00:01:49,000 --> 00:01:50,000
+the moment you import UserRepo.
+
+52
+00:01:50,000 --> 00:01:54,000
+So you can see the entire class is ready, the service,
+
+53
+00:01:54,000 --> 00:01:56,000
+but much detailed service is still not ready
+
+54
+00:01:56,000 --> 00:02:01,000
+because it is dependent on the UserPrincipal.
+
+55
+00:02:01,000 --> 00:02:03,000
+Okay, there's still some issue with this,
+
+56
+00:02:03,000 --> 00:02:06,000
+cannot resolve findByUsername in repo
+
+57
+00:02:06,000 --> 00:02:08,000
+because we have not imported the package.
+
+58
+00:02:08,000 --> 00:02:09,000
+Let's import the package for UserRepo,
+
+59
+00:02:09,000 --> 00:02:12,000
+which we have added, and now it is resolved.
+
+60
+00:02:12,000 --> 00:02:15,000
+But then not UserPrincipal. So now you know what to do.
+
+61
+00:02:15,000 --> 00:02:16,000
+Let's copy the UserPrincipal,
+
+62
+00:02:16,000 --> 00:02:19,000
+which goes into the model package.
+
+63
+00:02:20,000 --> 00:02:23,000
+Okay, there's no invite import here.
+
+64
+00:02:23,000 --> 00:02:25,000
+Everything looks cool,
+
+65
+00:02:25,000 --> 00:02:26,000
+but why is not giving error for user,
+
+66
+00:02:26,000 --> 00:02:28,000
+okay, it's in the same package.
+
+67
+00:02:28,000 --> 00:02:29,000
+Okay, no problem here, let me go back
+
+68
+00:02:29,000 --> 00:02:30,000
+to my UserDetailsService
+
+69
+00:02:30,000 --> 00:02:34,000
+and let's import this UserPrincipal class basically.
+
+70
+00:02:34,000 --> 00:02:37,000
+So we are importing that. Okay, what next?
+
+71
+00:02:37,000 --> 00:02:39,000
+Any problem you see there?
+
+72
+00:02:39,000 --> 00:02:42,000
+No, looks good. Everything.
+
+73
+00:02:42,000 --> 00:02:45,000
+Let me just check once any file, which I'm missing here. No.
+
+74
+00:02:45,000 --> 00:02:46,000
+In the application properties,
+
+75
+00:02:46,000 --> 00:02:48,000
+we do have database configuration,
+
+76
+00:02:48,000 --> 00:02:51,000
+but I think we already have that in the project.
+
+77
+00:02:51,000 --> 00:02:53,000
+So if you go back application properties,
+
+78
+00:02:53,000 --> 00:02:55,000
+we do have the connectivity with the password,
+
+79
+00:02:55,000 --> 00:02:57,000
+with the database, and we are using the same database.
+
+80
+00:02:57,000 --> 00:02:59,000
+There's no problem.
+
+81
+00:02:59,000 --> 00:03:00,000
+And if you don't have this configuration,
+
+82
+00:03:00,000 --> 00:03:01,000
+make sure you have it.
+
+83
+00:03:01,000 --> 00:03:03,000
+And even if you're using some different DBMS,
+
+84
+00:03:03,000 --> 00:03:06,000
+you have to change these particular details.
+
+85
+00:03:06,000 --> 00:03:07,000
+Everything else will remain same.
+
+86
+00:03:07,000 --> 00:03:12,000
+And yeah, I think our project is ready. Let's verify.
+
+87
+00:03:12,000 --> 00:03:14,000
+How do I verify? Just restart the application.
+
+88
+00:03:14,000 --> 00:03:16,000
+Restart, taking some time.
+
+89
+00:03:16,000 --> 00:03:19,000
+And you can say it is not generating a password now
+
+90
+00:03:19,000 --> 00:03:21,000
+because now we are using database, right?
+
+91
+00:03:21,000 --> 00:03:22,000
+Now what's the password in database?
+
+92
+00:03:22,000 --> 00:03:25,000
+So we have avni, where is our table?
+
+93
+00:03:25,000 --> 00:03:29,000
+So if I say users, view all rows.
+
+94
+00:03:29,000 --> 00:03:32,000
+So we got avni as a username, if you can see.
+
+95
+00:03:32,000 --> 00:03:33,000
+Yeah, so we got avni, let's use avni.
+
+96
+00:03:33,000 --> 00:03:36,000
+And the password is a@123.
+
+97
+00:03:36,000 --> 00:03:38,000
+But this is Pcrypt, but let's try that.
+
+98
+00:03:38,000 --> 00:03:39,000
+So let me go back to Postman now
+
+99
+00:03:39,000 --> 00:03:41,000
+and let's try to hit the URL.
+
+100
+00:03:41,000 --> 00:03:42,000
+Of course this will not work,
+
+101
+00:03:42,000 --> 00:03:45,000
+is because we have a wrong username password.
+
+102
+00:03:45,000 --> 00:03:47,000
+So let me use avni here.
+
+103
+00:03:47,000 --> 00:03:52,000
+And the password is a@123.
+
+104
+00:03:52,000 --> 00:03:55,000
+I hope this will work. Let's click on send, and it worked.
+
+105
+00:03:55,000 --> 00:03:56,000
+Okay, so yeah.
+
+106
+00:03:56,000 --> 00:03:58,000
+So our application is secured now,
+
+107
+00:03:58,000 --> 00:04:02,000
+the job portal, right, or the job app, which we have done.
+
+108
+00:04:02,000 --> 00:04:05,000
+So everything was working but it was not secure.
+
+109
+00:04:05,000 --> 00:04:07,000
+So we have done this security part.
+
+110
+00:04:07,000 --> 00:04:08,000
+Now what are the things we have added?
+
+111
+00:04:08,000 --> 00:04:10,000
+So if you go back to your job application,
+
+112
+00:04:10,000 --> 00:04:11,000
+we have added certain files.
+
+113
+00:04:11,000 --> 00:04:14,000
+We got SecurityConfig file in which you are saying
+
+114
+00:04:14,000 --> 00:04:17,000
+that I want to provide my own AuthenticationProvider.
+
+115
+00:04:17,000 --> 00:04:20,000
+And in the security filter I'm disabling the csrf,
+
+116
+00:04:20,000 --> 00:04:22,000
+I'm saying all the requests going
+
+117
+00:04:22,000 --> 00:04:23,000
+to the application should be authenticated.
+
+118
+00:04:23,000 --> 00:04:25,000
+I want to have a login page as well,
+
+119
+00:04:25,000 --> 00:04:26,000
+which works with HTTP headers.
+
+120
+00:04:26,000 --> 00:04:29,000
+You get a prompt there, not the form.
+
+121
+00:04:29,000 --> 00:04:33,000
+And then we are saying this session is stateless.
+
+122
+00:04:33,000 --> 00:04:35,000
+That's the thing we are doing here.
+
+123
+00:04:35,000 --> 00:04:39,000
+And if you see this particular SecurityConfig,
+
+124
+00:04:39,000 --> 00:04:41,000
+it is dependent upon the UserDetailsService.
+
+125
+00:04:41,000 --> 00:04:45,000
+And we have basically implemented this particular interface,
+
+126
+00:04:45,000 --> 00:04:47,000
+UserDetailsService in which you have this method,
+
+127
+00:04:47,000 --> 00:04:50,000
+loadUserByUsername, we are passing a username.
+
+128
+00:04:50,000 --> 00:04:51,000
+It is verifying that.
+
+129
+00:04:51,000 --> 00:04:54,000
+And to achieve this, it is using a User plus,
+
+130
+00:04:54,000 --> 00:04:57,000
+and also it returns the object
+
+131
+00:04:57,000 --> 00:04:58,000
+of UserPrincipals.
+
+132
+00:04:58,000 --> 00:04:59,000
+And the UserPrincipal,
+
+133
+00:04:59,000 --> 00:05:02,000
+basically we are implementing UserDetails
+
+134
+00:05:02,000 --> 00:05:04,000
+and then it has multiple methods in which you're
+
+135
+00:05:04,000 --> 00:05:05,000
+also specifying the role.
+
+136
+00:05:05,000 --> 00:05:09,000
+Maybe we have to also update this rules
+
+137
+00:05:09,000 --> 00:05:12,000
+because when you say you have a job portal,
+
+138
+00:05:12,000 --> 00:05:14,000
+we don't want everyone to add a job.
+
+139
+00:05:14,000 --> 00:05:16,000
+Only employers can do that.
+
+140
+00:05:16,000 --> 00:05:19,000
+And we don't want anyone to delete the jobs.
+
+141
+00:05:19,000 --> 00:05:21,000
+Only employers can do that.
+
+142
+00:05:21,000 --> 00:05:24,000
+Or maybe we can have a admin who can add the jobs
+
+143
+00:05:24,000 --> 00:05:26,000
+and remove the jobs, edit the jobs,
+
+144
+00:05:26,000 --> 00:05:28,000
+but job searching can be done by all the users.
+
+145
+00:05:28,000 --> 00:05:30,000
+Now that's something we can add here. Okay?
+
+146
+00:05:30,000 --> 00:05:33,000
+And yeah, that's it. Those are the things we have done.
+
+147
+00:05:33,000 --> 00:05:35,000
+We also got UserRepo, which is connecting with this table,
+
+148
+00:05:35,000 --> 00:05:37,000
+which is User, I mean User plus,
+
+149
+00:05:37,000 --> 00:05:40,000
+which is representing the users table.
+
+150
+00:05:41,000 --> 00:05:43,000
+Oh, it was not that long.
+
+151
+00:05:43,000 --> 00:05:45,000
+We completed the stuff very fast
+
+152
+00:05:45,000 --> 00:05:49,000
+because we have already done this in the previous section.
+
+153
+00:05:49,000 --> 00:05:50,000
+Okay?
+
+154
+00:05:50,000 --> 00:05:54,000
+So yeah, that's how we can secure our job portal.
+
+155
+00:05:54,000 --> 00:05:56,000
+We can also try this with our React application.
+
+156
+00:05:56,000 --> 00:05:58,000
+Maybe you can just modify your React application
+
+157
+00:05:58,000 --> 00:06:02,000
+by adding a username, password, or maybe a login form,
+
+158
+00:06:02,000 --> 00:06:06,000
+and just hit this URL just by passing the basic auth, right?
+
+159
+00:06:06,000 --> 00:06:07,000
+And if you do that, it'll work.
+
+160
+00:06:07,000 --> 00:06:11,000
+So yeah, that's it from this video where we talked about
+
+161
+00:06:11,000 --> 00:06:14,000
+how do you secure your job portal application,
+
+162
+00:06:14,000 --> 00:06:16,000
+which is this, or job application.
+
+163
+00:06:16,000 --> 00:06:17,000
+See you in the next topic.
+

21 - Securing Job App/004 Source-Code.url

@@ -0,0 +1,2 @@
+[InternetShortcut]
+URL=https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.4%20Job%20App%20Is%20Secure%20Now/spring-boot-rest

21 - Securing Job App/external-links.txt

@@ -0,0 +1,9 @@
+
+001 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.1%20Plan%20To%20Secure%20Job%20App%20Project/spring-boot-rest
+
+003 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.3%20Adding%20Security%20Configuration/spring-boot-rest
+
+004 Source-Code
+https://github.com/navinreddy20/spring6-course/tree/c6690e4f2c70d8f530d70623f13d14ff0ffd7e7d/12%20Spring%20security/13.4%20Job%20App%20Is%20Secure%20Now/spring-boot-rest

22 - JWT (JSON Web Token) and OAuth2/001 Encryption and Decryption_en.srt

@@ -0,0 +1,808 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:06,000
+-: In this video, we'll talk about cryptography.
+
+3
+00:00:06,000 --> 00:00:07,000
+So what happens is, on the internet,
+
+4
+00:00:07,000 --> 00:00:10,000
+basically you send information between the servers,
+
+5
+00:00:10,000 --> 00:00:13,000
+or from client to server, or server to client,
+
+6
+00:00:13,000 --> 00:00:15,000
+and when you say you are
+
+7
+00:00:15,000 --> 00:00:17,000
+sending this data through the internet,
+
+8
+00:00:17,000 --> 00:00:19,000
+anyone in between can check this data.
+
+9
+00:00:19,000 --> 00:00:21,000
+Of course, right, we have something
+
+10
+00:00:21,000 --> 00:00:23,000
+called man in middle attack.
+
+11
+00:00:23,000 --> 00:00:26,000
+Basically, they can see your data, they can modify the data.
+
+12
+00:00:26,000 --> 00:00:29,000
+So let's say, if person A says to person B,
+
+13
+00:00:29,000 --> 00:00:33,000
+"Hey, let's meet at a cafe at 5:00 PM,"
+
+14
+00:00:33,000 --> 00:00:36,000
+but then when the data is passing, the person C says,
+
+15
+00:00:36,000 --> 00:00:39,000
+"Okay, I want to make some modification here."
+
+16
+00:00:39,000 --> 00:00:42,000
+So they go there, they change this data from 5:00 to 6:00,
+
+17
+00:00:42,000 --> 00:00:44,000
+and they send it to B.
+
+18
+00:00:44,000 --> 00:00:48,000
+Now, here we are not just doing a passive attack
+
+19
+00:00:48,000 --> 00:00:49,000
+where you are able to read the data,
+
+20
+00:00:49,000 --> 00:00:51,000
+you are also doing a active attack.
+
+21
+00:00:51,000 --> 00:00:54,000
+Now, how do we secure ourself from this attack?
+
+22
+00:00:54,000 --> 00:00:56,000
+Now of course there have, we have to use some mechanism
+
+23
+00:00:56,000 --> 00:00:59,000
+where at least other person cannot see your data.
+
+24
+00:00:59,000 --> 00:01:01,000
+Even if they can see data,
+
+25
+00:01:01,000 --> 00:01:03,000
+they should not be able to read it.
+
+26
+00:01:03,000 --> 00:01:05,000
+And second, they should not be able to make the changes.
+
+27
+00:01:05,000 --> 00:01:06,000
+Even if they make the changes,
+
+28
+00:01:06,000 --> 00:01:10,000
+B should be able to know that something has changed,
+
+29
+00:01:10,000 --> 00:01:13,000
+and we can do that with the help of cryptography.
+
+30
+00:01:13,000 --> 00:01:14,000
+Now, in cryptography we use
+
+31
+00:01:14,000 --> 00:01:16,000
+a concept of encryption and decryption.
+
+32
+00:01:16,000 --> 00:01:20,000
+So let's say when A, is sending data to B now,
+
+33
+00:01:20,000 --> 00:01:22,000
+what you can do is you can do something
+
+34
+00:01:22,000 --> 00:01:23,000
+called an encryption here.
+
+35
+00:01:23,000 --> 00:01:25,000
+Now, to do the encryption,
+
+36
+00:01:25,000 --> 00:01:28,000
+what we basically do is we use a key,
+
+37
+00:01:28,000 --> 00:01:31,000
+and we change our data in such a way
+
+38
+00:01:31,000 --> 00:01:33,000
+that no one else can read it.
+
+39
+00:01:33,000 --> 00:01:35,000
+Of course, when you send the same data to B,
+
+40
+00:01:35,000 --> 00:01:37,000
+B cannot read that data now.
+
+41
+00:01:37,000 --> 00:01:40,000
+That's weird, I mean, we wanted B to know the data, right?
+
+42
+00:01:40,000 --> 00:01:43,000
+But then, what if you can share the key with B?
+
+43
+00:01:43,000 --> 00:01:46,000
+And now B should be able to decrypt it.
+
+44
+00:01:46,000 --> 00:01:48,000
+So, encryption simply means converting
+
+45
+00:01:48,000 --> 00:01:50,000
+your normal text to cipher text.
+
+46
+00:01:50,000 --> 00:01:52,000
+And decryption simply means
+
+47
+00:01:52,000 --> 00:01:55,000
+that you're converting your cipher text to a normal text.
+
+48
+00:01:55,000 --> 00:01:59,000
+So when A is writing the content, that will be your,
+
+49
+00:01:59,000 --> 00:02:00,000
+and that's your normal text,
+
+50
+00:02:00,000 --> 00:02:03,000
+but then you have to encrypt it so that no one can read it.
+
+51
+00:02:03,000 --> 00:02:05,000
+Even A cannot read that now.
+
+52
+00:02:05,000 --> 00:02:07,000
+Of course, A can read if A can decrypt it,
+
+53
+00:02:07,000 --> 00:02:11,000
+but now when you send this data to B, now B cannot read it,
+
+54
+00:02:11,000 --> 00:02:12,000
+so they have to decrypt it,
+
+55
+00:02:12,000 --> 00:02:14,000
+and they will simply, they can be able to read that.
+
+56
+00:02:14,000 --> 00:02:17,000
+Now, even if C is able to get the data,
+
+57
+00:02:17,000 --> 00:02:19,000
+C cannot read that because it is encrypted.
+
+58
+00:02:19,000 --> 00:02:21,000
+Now, how can B read it?
+
+59
+00:02:21,000 --> 00:02:25,000
+Because B has a key, C has no idea what that key is.
+
+60
+00:02:25,000 --> 00:02:27,000
+Now, this key is important here.
+
+61
+00:02:27,000 --> 00:02:29,000
+Now, this key can be of two different types.
+
+62
+00:02:29,000 --> 00:02:33,000
+A key can be a symmetric key or it can be a asymmetric key.
+
+63
+00:02:33,000 --> 00:02:35,000
+So in the symmetric key, what you have is,
+
+64
+00:02:35,000 --> 00:02:37,000
+you have keys which are same.
+
+65
+00:02:37,000 --> 00:02:40,000
+So A and B will have the same keys.
+
+66
+00:02:40,000 --> 00:02:44,000
+And of course, this can be any normal text or normal string,
+
+67
+00:02:44,000 --> 00:02:46,000
+which you can use as a key,
+
+68
+00:02:46,000 --> 00:02:47,000
+but they will be having the same key.
+
+69
+00:02:47,000 --> 00:02:51,000
+So if A is encrypting the data with this key,
+
+70
+00:02:51,000 --> 00:02:54,000
+the same key has to be there with B as well to decrypt it.
+
+71
+00:02:54,000 --> 00:02:57,000
+This is called a symmetric cryptography,
+
+72
+00:02:57,000 --> 00:02:59,000
+or symmetric key cryptography.
+
+73
+00:02:59,000 --> 00:03:01,000
+The problem with this is,
+
+74
+00:03:01,000 --> 00:03:04,000
+this key need to be shared before the communication.
+
+75
+00:03:04,000 --> 00:03:07,000
+Of course, they cannot share this key on the internet now
+
+76
+00:03:07,000 --> 00:03:09,000
+because if they share this key on the internet,
+
+77
+00:03:09,000 --> 00:03:12,000
+C can see the key and then C will say,
+
+78
+00:03:12,000 --> 00:03:13,000
+"Okay, I got the key, now.
+
+79
+00:03:13,000 --> 00:03:15,000
+Even if you encrypted, I can read that."
+
+80
+00:03:15,000 --> 00:03:17,000
+So that's one challenge here.
+
+81
+00:03:17,000 --> 00:03:19,000
+This key need to be shared beforehand.
+
+82
+00:03:19,000 --> 00:03:22,000
+Maybe they can meet somewhere in person,
+
+83
+00:03:22,000 --> 00:03:25,000
+share the key and go back and do the communication.
+
+84
+00:03:25,000 --> 00:03:27,000
+Again, a weird way of sharing a key,
+
+85
+00:03:27,000 --> 00:03:29,000
+but again, it's very famous,
+
+86
+00:03:29,000 --> 00:03:31,000
+the symmetric cryptography, it is faster,
+
+87
+00:03:31,000 --> 00:03:34,000
+and you can also have a large key size,
+
+88
+00:03:34,000 --> 00:03:36,000
+and the bigger the key size you have, it's more secure.
+
+89
+00:03:36,000 --> 00:03:39,000
+The challenge is of course the key sharing.
+
+90
+00:03:39,000 --> 00:03:42,000
+And also, what if you have multiple members in the network?
+
+91
+00:03:42,000 --> 00:03:43,000
+We have D, E,
+
+92
+00:03:43,000 --> 00:03:46,000
+and maybe A want to do communications with D now.
+
+93
+00:03:46,000 --> 00:03:47,000
+So of course, they have to use a different key.
+
+94
+00:03:47,000 --> 00:03:50,000
+They cannot use the same key which is shared by A and B.
+
+95
+00:03:50,000 --> 00:03:55,000
+Maybe if you say K1 is the key used by A and B,
+
+96
+00:03:55,000 --> 00:03:57,000
+now A cannot use the same key with D,
+
+97
+00:03:57,000 --> 00:04:00,000
+they need to have a different key, let's say K2.
+
+98
+00:04:00,000 --> 00:04:02,000
+What if D wants to communicate with E?
+
+99
+00:04:02,000 --> 00:04:05,000
+Of course, they have to have a different key, which is K3.
+
+100
+00:04:05,000 --> 00:04:08,000
+That's how you basically have multiple keys
+
+101
+00:04:08,000 --> 00:04:10,000
+in symmetric key cryptography.
+
+102
+00:04:10,000 --> 00:04:13,000
+And the problem is, managing this key becomes difficult.
+
+103
+00:04:13,000 --> 00:04:15,000
+What if A want to communicate with everyone?
+
+104
+00:04:15,000 --> 00:04:17,000
+So A has to manage those number of
+
+105
+00:04:17,000 --> 00:04:18,000
+those amount of keys with A.
+
+106
+00:04:18,000 --> 00:04:21,000
+The solution for this is asymmetric cryptography,
+
+107
+00:04:21,000 --> 00:04:23,000
+where you don't have a symmetric key.
+
+108
+00:04:23,000 --> 00:04:25,000
+Of course, that's what asymmetric means.
+
+109
+00:04:25,000 --> 00:04:26,000
+But what you basically have
+
+110
+00:04:26,000 --> 00:04:29,000
+is you have a concept of public and private key.
+
+111
+00:04:29,000 --> 00:04:30,000
+Now, how this works.
+
+112
+00:04:30,000 --> 00:04:33,000
+For the encryption and decryption, you'll be using two keys,
+
+113
+00:04:33,000 --> 00:04:35,000
+encrypt the public key and a private key.
+
+114
+00:04:35,000 --> 00:04:36,000
+And how that works is,
+
+115
+00:04:36,000 --> 00:04:40,000
+if you encrypt a data with a private key,
+
+116
+00:04:40,000 --> 00:04:42,000
+then you have to decrypt the data with a public key.
+
+117
+00:04:42,000 --> 00:04:44,000
+And when you encrypt the data with public key,
+
+118
+00:04:44,000 --> 00:04:46,000
+you have to decrypt the data with private key.
+
+119
+00:04:46,000 --> 00:04:47,000
+So basically,
+
+120
+00:04:47,000 --> 00:04:50,000
+you have to use the opposite keys
+
+121
+00:04:50,000 --> 00:04:50,000
+for encryption, decryption.
+
+122
+00:04:50,000 --> 00:04:53,000
+You can't use same key for both.
+
+123
+00:04:53,000 --> 00:04:54,000
+Now, what happens is,
+
+124
+00:04:54,000 --> 00:04:56,000
+now since private key is a private key,
+
+125
+00:04:56,000 --> 00:04:58,000
+only the owner knows the private key.
+
+126
+00:04:58,000 --> 00:04:59,000
+What about the public key?
+
+127
+00:04:59,000 --> 00:05:03,000
+Public key is known by everyone in the network. Okay?
+
+128
+00:05:03,000 --> 00:05:04,000
+Now, what's the advantage of this?
+
+129
+00:05:04,000 --> 00:05:05,000
+So, let's say there's
+
+130
+00:05:05,000 --> 00:05:08,000
+a public key and private key with the B,
+
+131
+00:05:08,000 --> 00:05:10,000
+and now A wants to send data.
+
+132
+00:05:10,000 --> 00:05:12,000
+Now, a question arise, what key A will use.
+
+133
+00:05:14,000 --> 00:05:17,000
+Can A use a private key of B? Of course not.
+
+134
+00:05:17,000 --> 00:05:20,000
+Private key is only known by B,
+
+135
+00:05:20,000 --> 00:05:22,000
+but then public key is known by everyone.
+
+136
+00:05:22,000 --> 00:05:23,000
+So let's say that we have a central repository
+
+137
+00:05:23,000 --> 00:05:25,000
+where you have all these keys,
+
+138
+00:05:25,000 --> 00:05:28,000
+public keys of all the members in the network, right?
+
+139
+00:05:28,000 --> 00:05:29,000
+So they don't have to basically
+
+140
+00:05:29,000 --> 00:05:31,000
+ask B to give you a public key.
+
+141
+00:05:31,000 --> 00:05:33,000
+Everyone knows what is a public key for B.
+
+142
+00:05:33,000 --> 00:05:35,000
+And since it's a public key, there's no risk here.
+
+143
+00:05:35,000 --> 00:05:38,000
+Now, when A wants to send this data,
+
+144
+00:05:38,000 --> 00:05:41,000
+what a will do is A will use B's public key to encrypt.
+
+145
+00:05:41,000 --> 00:05:43,000
+The beauty is, when B receives the message,
+
+146
+00:05:43,000 --> 00:05:48,000
+B can decrypt with its own private key.
+
+147
+00:05:48,000 --> 00:05:51,000
+And only B can do that, because B knows the private key.
+
+148
+00:05:51,000 --> 00:05:52,000
+What if C comes in between and say,
+
+149
+00:05:52,000 --> 00:05:55,000
+"Hey, I got the data, now I want to decrypt it."
+
+150
+00:05:55,000 --> 00:05:57,000
+C can't decrypt that with C's private key.
+
+151
+00:05:57,000 --> 00:06:01,000
+It can be only decrypt with the B's private key.
+
+152
+00:06:01,000 --> 00:06:03,000
+Okay, that's how you basically use
+
+153
+00:06:03,000 --> 00:06:04,000
+asymmetric cryptographic here.
+
+154
+00:06:04,000 --> 00:06:06,000
+Now, there are different algorithms available.
+
+155
+00:06:06,000 --> 00:06:08,000
+Now, the question arise,
+
+156
+00:06:08,000 --> 00:06:09,000
+everyone in the network will have their own
+
+157
+00:06:09,000 --> 00:06:11,000
+private key and public key, right?
+
+158
+00:06:11,000 --> 00:06:12,000
+And they know their private key,
+
+159
+00:06:12,000 --> 00:06:13,000
+and public key is known by everyone.
+
+160
+00:06:13,000 --> 00:06:16,000
+Now, when D want to send data to E,
+
+161
+00:06:16,000 --> 00:06:17,000
+basically they will be,
+
+162
+00:06:17,000 --> 00:06:19,000
+so let's say D want to send data to E.
+
+163
+00:06:19,000 --> 00:06:21,000
+So D will use E's public key to encrypt
+
+164
+00:06:21,000 --> 00:06:24,000
+and E will use E's private key to decrypt.
+
+165
+00:06:24,000 --> 00:06:27,000
+So that's basically the asymmetric box.
+
+166
+00:06:27,000 --> 00:06:29,000
+There are different algorithms available for symmetric key,
+
+167
+00:06:29,000 --> 00:06:32,000
+or we have algorithm like AES or DES.
+
+168
+00:06:32,000 --> 00:06:34,000
+There are multiple algorithms available.
+
+169
+00:06:34,000 --> 00:06:37,000
+Every algorithm have their own strength and weaknesses.
+
+170
+00:06:37,000 --> 00:06:41,000
+Same goes for asymmetric key, where you have RSA, ECC.
+
+171
+00:06:41,000 --> 00:06:44,000
+So we have multiple algorithms available to use.
+
+172
+00:06:44,000 --> 00:06:46,000
+Now, depending upon different situation,
+
+173
+00:06:46,000 --> 00:06:47,000
+we can use different algorithms,
+
+174
+00:06:47,000 --> 00:06:50,000
+and some are faster, some are more secure.
+
+175
+00:06:50,000 --> 00:06:54,000
+Some depending upon that, you can use any algorithm there.
+
+176
+00:06:54,000 --> 00:06:55,000
+But now question arise.
+
+177
+00:06:55,000 --> 00:06:59,000
+Let's say A is sending the data to B
+
+178
+00:06:59,000 --> 00:07:01,000
+and say, "Hey, I want to meet at 5:00 PM,"
+
+179
+00:07:01,000 --> 00:07:04,000
+and maybe there's nothing secret here, okay?
+
+180
+00:07:04,000 --> 00:07:06,000
+So now let's say A want to send a message to B by saying,
+
+181
+00:07:06,000 --> 00:07:09,000
+"Hey, let's meet at 5:00 PM,"
+
+182
+00:07:09,000 --> 00:07:11,000
+and the message is going on the network.
+
+183
+00:07:11,000 --> 00:07:12,000
+Now, C comes in between and say,
+
+184
+00:07:12,000 --> 00:07:14,000
+"Hey, let me just hack that packet,
+
+185
+00:07:14,000 --> 00:07:17,000
+and now let me send a new packet."
+
+186
+00:07:17,000 --> 00:07:20,000
+And C says, "Let's meet at 6:00 PM."
+
+187
+00:07:20,000 --> 00:07:23,000
+Now, how C will encrypt it?
+
+188
+00:07:23,000 --> 00:07:25,000
+So what C will do is, so C will use B's public key,
+
+189
+00:07:25,000 --> 00:07:29,000
+which A also did, and send that message to B,
+
+190
+00:07:29,000 --> 00:07:32,000
+and B says, okay, I got a message and it is encrypted.
+
+191
+00:07:32,000 --> 00:07:34,000
+Let me use my private key to decrypt. Decryption done.
+
+192
+00:07:34,000 --> 00:07:36,000
+So that means I have to meet at 6:00 PM.
+
+193
+00:07:36,000 --> 00:07:39,000
+Okay, so when you are using this cryptography,
+
+194
+00:07:39,000 --> 00:07:41,000
+you are basically encrypting data and decrypting it,
+
+195
+00:07:41,000 --> 00:07:43,000
+but there's no way to prove
+
+196
+00:07:43,000 --> 00:07:45,000
+that the sender is the actual sender.
+
+197
+00:07:45,000 --> 00:07:49,000
+So, maybe B is thinking the message is sent by A,
+
+198
+00:07:49,000 --> 00:07:51,000
+but it is actually sent by C.
+
+199
+00:07:51,000 --> 00:07:54,000
+How do you maintain that identity here?
+
+200
+00:07:54,000 --> 00:07:56,000
+Now, that's where you can use something
+
+201
+00:07:56,000 --> 00:07:58,000
+called a digital signature.
+
+202
+00:07:58,000 --> 00:08:00,000
+And let's talk about data signature in the next video.
+

22 - JWT (JSON Web Token) and OAuth2/002 Digital Signature_en.srt

@@ -0,0 +1,384 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle bright music)
+
+2
+00:00:03,000 --> 00:00:05,000
+-: Now we know about encryption/decryption,
+
+3
+00:00:05,000 --> 00:00:07,000
+but then there was no way to prove that the person
+
+4
+00:00:07,000 --> 00:00:10,000
+who is sending the message is actually that person.
+
+5
+00:00:10,000 --> 00:00:11,000
+Now the way you can do that
+
+6
+00:00:11,000 --> 00:00:13,000
+is with the help of digital signature.
+
+7
+00:00:13,000 --> 00:00:15,000
+Now what we do here is
+
+8
+00:00:15,000 --> 00:00:17,000
+what if we don't want to secure the information,
+
+9
+00:00:17,000 --> 00:00:21,000
+but we want to prove that we are the real person?
+
+10
+00:00:21,000 --> 00:00:23,000
+Now in that case, what A will do is,
+
+11
+00:00:23,000 --> 00:00:26,000
+A will not encrypt the message with B's public key,
+
+12
+00:00:26,000 --> 00:00:28,000
+which he was doing before.
+
+13
+00:00:28,000 --> 00:00:31,000
+Now what A will do is A will encrypt a message
+
+14
+00:00:31,000 --> 00:00:35,000
+with its own private key.
+
+15
+00:00:35,000 --> 00:00:37,000
+Remember that we are not using B's public key here.
+
+16
+00:00:37,000 --> 00:00:39,000
+We're using A's private key.
+
+17
+00:00:39,000 --> 00:00:42,000
+Now after encryption, the packet goes to B.
+
+18
+00:00:42,000 --> 00:00:43,000
+Now how B can decrypt it?
+
+19
+00:00:43,000 --> 00:00:46,000
+Of course, can I use a B's private key?
+
+20
+00:00:46,000 --> 00:00:49,000
+No, because it is encrypted by A's private key.
+
+21
+00:00:49,000 --> 00:00:51,000
+And the only way you can decrypt that
+
+22
+00:00:51,000 --> 00:00:53,000
+is with the help of A's public key.
+
+23
+00:00:53,000 --> 00:00:55,000
+If the decryption is possible,
+
+24
+00:00:55,000 --> 00:00:59,000
+that means that there's a proof that only A has sent it.
+
+25
+00:00:59,000 --> 00:01:00,000
+What if, let's try to attack here?
+
+26
+00:01:00,000 --> 00:01:03,000
+What if C says, "I want to send this data."
+
+27
+00:01:03,000 --> 00:01:05,000
+So when the message is going from A to B,
+
+28
+00:01:05,000 --> 00:01:08,000
+C comes in between say, "Hey, let me hack this message."
+
+29
+00:01:08,000 --> 00:01:10,000
+And message is gone.
+
+30
+00:01:10,000 --> 00:01:12,000
+Now C is sending a new message
+
+31
+00:01:12,000 --> 00:01:14,000
+and which key C is going to use?
+
+32
+00:01:14,000 --> 00:01:17,000
+C is going to use C's private key.
+
+33
+00:01:17,000 --> 00:01:19,000
+And now when it goes to B,
+
+34
+00:01:19,000 --> 00:01:22,000
+B is not able to decrypt that with A's public key.
+
+35
+00:01:22,000 --> 00:01:24,000
+It is only possible with the help of C's public key.
+
+36
+00:01:24,000 --> 00:01:27,000
+And now B knows something is wrong.
+
+37
+00:01:27,000 --> 00:01:28,000
+It's not coming from A.
+
+38
+00:01:28,000 --> 00:01:31,000
+And that's how you prove that the data is not coming from A.
+
+39
+00:01:31,000 --> 00:01:33,000
+It came from someone else.
+
+40
+00:01:33,000 --> 00:01:35,000
+But what if it was possible to decrypt that
+
+41
+00:01:35,000 --> 00:01:36,000
+with A's public key?
+
+42
+00:01:36,000 --> 00:01:38,000
+That means we have a proof that A has sent it.
+
+43
+00:01:38,000 --> 00:01:42,000
+Now a cannot say later that, "Hey, I have not sent that."
+
+44
+00:01:42,000 --> 00:01:43,000
+It's a proof, right?
+
+45
+00:01:43,000 --> 00:01:45,000
+A has encrypted that with A's private key
+
+46
+00:01:45,000 --> 00:01:49,000
+and only A knows its own private key.
+
+47
+00:01:49,000 --> 00:01:50,000
+And that's important.
+
+48
+00:01:50,000 --> 00:01:52,000
+This is called digital signature.
+
+49
+00:01:52,000 --> 00:01:53,000
+But there's one problem here.
+
+50
+00:01:53,000 --> 00:01:55,000
+We don't have security.
+
+51
+00:01:55,000 --> 00:01:58,000
+We do have a proof that who has sent it,
+
+52
+00:01:58,000 --> 00:01:59,000
+but anyone can read data.
+
+53
+00:01:59,000 --> 00:02:02,000
+You know, C can also read that data.
+
+54
+00:02:02,000 --> 00:02:03,000
+Because when C gets this packet,
+
+55
+00:02:03,000 --> 00:02:06,000
+which says, "Let's meet at 5:00 PM,"
+
+56
+00:02:06,000 --> 00:02:08,000
+C is able to decrypt it
+
+57
+00:02:08,000 --> 00:02:11,000
+because A has signed it with a private key,
+
+58
+00:02:11,000 --> 00:02:15,000
+and to decrypt it, C can use A's public key.
+
+59
+00:02:15,000 --> 00:02:16,000
+You're hacked.
+
+60
+00:02:16,000 --> 00:02:18,000
+So how do we secure it?
+
+61
+00:02:18,000 --> 00:02:20,000
+So that's why we have to do double encryption.
+
+62
+00:02:20,000 --> 00:02:21,000
+I mean think about this.
+
+63
+00:02:21,000 --> 00:02:24,000
+What if you are basically first,
+
+64
+00:02:24,000 --> 00:02:26,000
+so let's say A want to send message to B.
+
+65
+00:02:26,000 --> 00:02:30,000
+First, A will use B's public key to encrypt.
+
+66
+00:02:30,000 --> 00:02:31,000
+So first layer done.
+
+67
+00:02:31,000 --> 00:02:34,000
+Then the same packet will be encrypted again
+
+68
+00:02:34,000 --> 00:02:36,000
+with A's private key.
+
+69
+00:02:36,000 --> 00:02:38,000
+So double encryption.
+
+70
+00:02:38,000 --> 00:02:39,000
+Now when the packet goes to B,
+
+71
+00:02:39,000 --> 00:02:42,000
+B says, "Okay, it is encrypted with A's private key.
+
+72
+00:02:42,000 --> 00:02:45,000
+Let me decrypt it with A's public key."
+
+73
+00:02:45,000 --> 00:02:45,000
+Decryption done.
+
+74
+00:02:45,000 --> 00:02:48,000
+That means there's a proof that A has sent it,
+
+75
+00:02:48,000 --> 00:02:51,000
+and then again the package is still encrypted.
+
+76
+00:02:51,000 --> 00:02:54,000
+So again, it will do decryption again with B's private key
+
+77
+00:02:55,000 --> 00:02:57,000
+because no one knows the B's private key.
+
+78
+00:02:57,000 --> 00:02:59,000
+And now, B got the message
+
+79
+00:02:59,000 --> 00:03:03,000
+and we have achieved security as well as identity.
+
+80
+00:03:03,000 --> 00:03:05,000
+But what if, let's try to attack here?
+
+81
+00:03:05,000 --> 00:03:06,000
+So let's say C comes in between
+
+82
+00:03:06,000 --> 00:03:08,000
+and say, "Hey, I want to attack now."
+
+83
+00:03:08,000 --> 00:03:09,000
+C receives a package
+
+84
+00:03:09,000 --> 00:03:13,000
+and says, "Okay, it is encrypted with A's private key.
+
+85
+00:03:13,000 --> 00:03:15,000
+Let me decrypt it with A's public key."
+
+86
+00:03:15,000 --> 00:03:16,000
+Decryption done.
+
+87
+00:03:16,000 --> 00:03:19,000
+But now it is still encrypted with B's public key.
+
+88
+00:03:19,000 --> 00:03:20,000
+Can C decrypt it?
+
+89
+00:03:20,000 --> 00:03:24,000
+No, because C has no idea what's B's private key
+
+90
+00:03:24,000 --> 00:03:26,000
+and you're safe, right?
+
+91
+00:03:26,000 --> 00:03:28,000
+So this is how basically you achieve signature
+
+92
+00:03:28,000 --> 00:03:29,000
+with encryption.
+
+93
+00:03:29,000 --> 00:03:31,000
+And this will be used in the upcoming session,
+
+94
+00:03:31,000 --> 00:03:34,000
+so I hope you understood what is cryptography,
+
+95
+00:03:34,000 --> 00:03:38,000
+what is encryption/decryption, and what is signature.
+
+96
+00:03:38,000 --> 00:03:39,000
+See you in the next video.
+

22 - JWT (JSON Web Token) and OAuth2/003 Why JWT_en.srt

@@ -0,0 +1,792 @@
+1
+00:00:00,000 --> 00:00:03,000
+(bright music)
+
+2
+00:00:03,000 --> 00:00:06,000
+-: In this video, we'll talk about JWT,
+
+3
+00:00:06,000 --> 00:00:08,000
+which stands for JSON Web Tokens.
+
+4
+00:00:08,000 --> 00:00:10,000
+Now, before we go there, let's take an example.
+
+5
+00:00:10,000 --> 00:00:13,000
+So let's say every day when I go to my office,
+
+6
+00:00:13,000 --> 00:00:14,000
+so we have a cafe,
+
+7
+00:00:14,000 --> 00:00:16,000
+which is just between my home and my office.
+
+8
+00:00:16,000 --> 00:00:18,000
+I go there to have a coffee,
+
+9
+00:00:18,000 --> 00:00:20,000
+and then I go to my office.
+
+10
+00:00:20,000 --> 00:00:21,000
+Of course, for every coffee,
+
+11
+00:00:21,000 --> 00:00:22,000
+I have to pay some amount.
+
+12
+00:00:22,000 --> 00:00:25,000
+Let's say I'm paying $1 per coffee every day.
+
+13
+00:00:25,000 --> 00:00:27,000
+And then, I'm doing this every day, right?
+
+14
+00:00:27,000 --> 00:00:30,000
+Now, what if I can talk to them by saying,
+
+15
+00:00:30,000 --> 00:00:32,000
+"Hey, you know, I come there every day.
+
+16
+00:00:32,000 --> 00:00:35,000
+Let me take a membership of a month."
+
+17
+00:00:35,000 --> 00:00:36,000
+So maybe I can get a discount.
+
+18
+00:00:36,000 --> 00:00:38,000
+I mean, I'm going there every day.
+
+19
+00:00:38,000 --> 00:00:40,000
+So what if I can get, let's say in $20,
+
+20
+00:00:40,000 --> 00:00:42,000
+I can get for the entire month.
+
+21
+00:00:42,000 --> 00:00:44,000
+And now the person knows me.
+
+22
+00:00:44,000 --> 00:00:46,000
+So basically every day, we see each other.
+
+23
+00:00:46,000 --> 00:00:47,000
+So now he knows who I am.
+
+24
+00:00:47,000 --> 00:00:52,000
+And then he says, "Okay, now we got $20 from you.
+
+25
+00:00:52,000 --> 00:00:54,000
+You can come for the entire month and have a coffee."
+
+26
+00:00:54,000 --> 00:00:58,000
+Now, I went there for first day, second day, third day,
+
+27
+00:00:58,000 --> 00:00:59,000
+and then everything was working.
+
+28
+00:00:59,000 --> 00:01:01,000
+So he know my face.
+
+29
+00:01:01,000 --> 00:01:04,000
+And the problem is, what if the person changes?
+
+30
+00:01:04,000 --> 00:01:06,000
+Now, of course, we don't want that scenario, right?
+
+31
+00:01:06,000 --> 00:01:08,000
+Where I go to a cafe after one week
+
+32
+00:01:08,000 --> 00:01:09,000
+and I see another person,
+
+33
+00:01:09,000 --> 00:01:11,000
+and then this person says, "Who are you?"
+
+34
+00:01:11,000 --> 00:01:12,000
+We don't want that.
+
+35
+00:01:12,000 --> 00:01:14,000
+So maybe there should be some entry in a book
+
+36
+00:01:14,000 --> 00:01:17,000
+where they can make an entry by saying:
+
+37
+00:01:17,000 --> 00:01:19,000
+This person has taken a subscription of one month,
+
+38
+00:01:19,000 --> 00:01:22,000
+and every time this person comes, we can give them a coffee.
+
+39
+00:01:22,000 --> 00:01:25,000
+And now let's say we have an entry there.
+
+40
+00:01:25,000 --> 00:01:27,000
+So I can go there, I can tell,
+
+41
+00:01:27,000 --> 00:01:29,000
+"Hey, there should be my entry.
+
+42
+00:01:29,000 --> 00:01:32,000
+And for the entry, I also got id. So it's my ID is 102.
+
+43
+00:01:32,000 --> 00:01:34,000
+And every time I go there, I can say,
+
+44
+00:01:34,000 --> 00:01:36,000
+this is my id, which is 102.
+
+45
+00:01:36,000 --> 00:01:39,000
+And they can refer in that book. Yeah.
+
+46
+00:01:39,000 --> 00:01:40,000
+So we have an id, which is 102,
+
+47
+00:01:40,000 --> 00:01:43,000
+which says Navin Reddy subscription for one month.
+
+48
+00:01:43,000 --> 00:01:46,000
+That's great. So now I can get my coffee.
+
+49
+00:01:46,000 --> 00:01:49,000
+So this, this model works better, right?
+
+50
+00:01:49,000 --> 00:01:50,000
+Where I can get ID as well,
+
+51
+00:01:50,000 --> 00:01:52,000
+not just person knows me with my face.
+
+52
+00:01:52,000 --> 00:01:54,000
+Now there's one little problem.
+
+53
+00:01:54,000 --> 00:01:57,000
+So let's say with this cafe has multiple branches, okay?
+
+54
+00:01:57,000 --> 00:01:59,000
+So it is there in my area,
+
+55
+00:01:59,000 --> 00:02:01,000
+but let's say I go to go for some training
+
+56
+00:02:01,000 --> 00:02:02,000
+in different cities.
+
+57
+00:02:02,000 --> 00:02:06,000
+I go to let's say Delhi or Bangalore or Mumbai,
+
+58
+00:02:06,000 --> 00:02:08,000
+and maybe they have the branches.
+
+59
+00:02:08,000 --> 00:02:10,000
+Of course they have scaled out well
+
+60
+00:02:10,000 --> 00:02:12,000
+and now they have branches in different cities.
+
+61
+00:02:12,000 --> 00:02:15,000
+So let's say if one day I'm not in my hometown,
+
+62
+00:02:15,000 --> 00:02:17,000
+I'm going to a different city
+
+63
+00:02:17,000 --> 00:02:20,000
+and I see a cafe there, the question is,
+
+64
+00:02:20,000 --> 00:02:22,000
+will I get the free coffee?
+
+65
+00:02:22,000 --> 00:02:24,000
+I mean, not free, but I got the membership, right?
+
+66
+00:02:24,000 --> 00:02:26,000
+I should not, I don't have to pay for it.
+
+67
+00:02:26,000 --> 00:02:28,000
+But then when I go there by saying,
+
+68
+00:02:28,000 --> 00:02:30,000
+hey, you know, I have id, which is 102,
+
+69
+00:02:30,000 --> 00:02:31,000
+please check your book.
+
+70
+00:02:31,000 --> 00:02:32,000
+That should be my entry.
+
+71
+00:02:32,000 --> 00:02:34,000
+What do you think?
+
+72
+00:02:34,000 --> 00:02:36,000
+Will there be a coffee there or the entry there?
+
+73
+00:02:36,000 --> 00:02:39,000
+Of course not, because the book is there in my hometown.
+
+74
+00:02:39,000 --> 00:02:41,000
+It's not there in every city.
+
+75
+00:02:41,000 --> 00:02:43,000
+So that's the problem of scaling, which I'm talking about.
+
+76
+00:02:43,000 --> 00:02:45,000
+So what is the solution here?
+
+77
+00:02:45,000 --> 00:02:49,000
+The solution could be one where instead of them
+
+78
+00:02:49,000 --> 00:02:51,000
+making an entry on their book,
+
+79
+00:02:51,000 --> 00:02:54,000
+what if they can give me a pass, a monthly pass, which says,
+
+80
+00:02:54,000 --> 00:02:58,000
+Navin Reddy has already paid $20 for the entire month
+
+81
+00:02:58,000 --> 00:03:00,000
+and from this date to this date,
+
+82
+00:03:00,000 --> 00:03:04,000
+if the person has this pass, you can give them a coffee.
+
+83
+00:03:04,000 --> 00:03:05,000
+And that perfectly works, right?
+
+84
+00:03:05,000 --> 00:03:07,000
+I can just go there in any of the branch,
+
+85
+00:03:07,000 --> 00:03:10,000
+doesn't matter the location, I will get the coffee.
+
+86
+00:03:10,000 --> 00:03:12,000
+Okay, that sounds good, right?
+
+87
+00:03:12,000 --> 00:03:15,000
+And I shared this model with my friend
+
+88
+00:03:15,000 --> 00:03:17,000
+and now he knows that if you have that pass,
+
+89
+00:03:17,000 --> 00:03:18,000
+you will get a free coffee.
+
+90
+00:03:18,000 --> 00:03:22,000
+So what he did, he basically printed a coupon which says,
+
+91
+00:03:22,000 --> 00:03:26,000
+let's say Harsh now also paid $20
+
+92
+00:03:26,000 --> 00:03:29,000
+and he will get a subscription for the entire month.
+
+93
+00:03:29,000 --> 00:03:31,000
+But Harsh has not done that.
+
+94
+00:03:31,000 --> 00:03:35,000
+He is creating his own coupon just by copying my coupon.
+
+95
+00:03:35,000 --> 00:03:36,000
+And anyone can do that, right?
+
+96
+00:03:36,000 --> 00:03:39,000
+So they will go to a coffee shop and say, "Hey, I'm Harsh.
+
+97
+00:03:39,000 --> 00:03:42,000
+I already paid for $20 for the coffee,"
+
+98
+00:03:42,000 --> 00:03:44,000
+but that coupon is not valid.
+
+99
+00:03:44,000 --> 00:03:45,000
+How do I identify that?
+
+100
+00:03:45,000 --> 00:03:47,000
+So one way this cafes can improve is
+
+101
+00:03:47,000 --> 00:03:51,000
+what if with the coupon they also sign it,
+
+102
+00:03:51,000 --> 00:03:53,000
+maybe a manager sign or maybe a company stamp
+
+103
+00:03:53,000 --> 00:03:56,000
+or maybe a digital signature if it is online.
+
+104
+00:03:56,000 --> 00:03:59,000
+And now that is something which can prove
+
+105
+00:03:59,000 --> 00:04:00,000
+that this company coupon is valid.
+
+106
+00:04:00,000 --> 00:04:03,000
+So we moved from having an entry on a book
+
+107
+00:04:03,000 --> 00:04:07,000
+and giving you an ID instead of that give a pass itself,
+
+108
+00:04:07,000 --> 00:04:08,000
+which which mentions everything.
+
+109
+00:04:08,000 --> 00:04:11,000
+So in the pass itself, you have all the data,
+
+110
+00:04:11,000 --> 00:04:14,000
+the person name, at what time this coupon was issued,
+
+111
+00:04:14,000 --> 00:04:15,000
+what is the expression,
+
+112
+00:04:15,000 --> 00:04:17,000
+expression, time, and the rules as well.
+
+113
+00:04:17,000 --> 00:04:19,000
+So you are here just for the coffee,
+
+114
+00:04:19,000 --> 00:04:21,000
+not for the entire things on the cafe.
+
+115
+00:04:21,000 --> 00:04:23,000
+Maybe the cafe sells a lot of different stuff
+
+116
+00:04:23,000 --> 00:04:24,000
+apart from coffee.
+
+117
+00:04:24,000 --> 00:04:27,000
+What I will get is only coffee, right?
+
+118
+00:04:27,000 --> 00:04:29,000
+So those things will be mentioned on the pass.
+
+119
+00:04:29,000 --> 00:04:33,000
+So which is better having an ID or this pass?
+
+120
+00:04:33,000 --> 00:04:35,000
+Of course, both have their own advantages and drawbacks,
+
+121
+00:04:35,000 --> 00:04:39,000
+but this is another way of having that session.
+
+122
+00:04:39,000 --> 00:04:41,000
+Now, coming back to the IT world,
+
+123
+00:04:41,000 --> 00:04:43,000
+we have client and server
+
+124
+00:04:43,000 --> 00:04:45,000
+where client goes to the server by saying,
+
+125
+00:04:45,000 --> 00:04:46,000
+"Hey, I want a resource."
+
+126
+00:04:46,000 --> 00:04:48,000
+Now if it is static page,
+
+127
+00:04:48,000 --> 00:04:49,000
+we don't have to verify who the user is.
+
+128
+00:04:49,000 --> 00:04:51,000
+I can simply turn a static page.
+
+129
+00:04:51,000 --> 00:04:53,000
+But what if I want to change the data
+
+130
+00:04:53,000 --> 00:04:55,000
+based on the user request?
+
+131
+00:04:55,000 --> 00:04:57,000
+So let's say if I go to my social media app,
+
+132
+00:04:57,000 --> 00:04:58,000
+maybe it can be Instagram, YouTube,
+
+133
+00:04:58,000 --> 00:05:00,000
+and if I want to see the content,
+
+134
+00:05:00,000 --> 00:05:02,000
+or maybe I go to Facebook to see my friend list,
+
+135
+00:05:02,000 --> 00:05:05,000
+I want to see only my things, not others,
+
+136
+00:05:05,000 --> 00:05:08,000
+other, other settings right?
+
+137
+00:05:08,000 --> 00:05:10,000
+Now, in this case, the server should know who I am.
+
+138
+00:05:10,000 --> 00:05:12,000
+I can of, of course I can claim
+
+139
+00:05:12,000 --> 00:05:14,000
+I'm this person, but how do I verify that?
+
+140
+00:05:14,000 --> 00:05:16,000
+That's right. You're thinking about login.
+
+141
+00:05:16,000 --> 00:05:20,000
+But after doing a login, the server is basically stateless.
+
+142
+00:05:20,000 --> 00:05:22,000
+How do you manage there?
+
+143
+00:05:22,000 --> 00:05:24,000
+So one way you can do it on the server side,
+
+144
+00:05:24,000 --> 00:05:25,000
+you can make an entry.
+
+145
+00:05:25,000 --> 00:05:29,000
+So once I log in, the server says, okay, I know you,
+
+146
+00:05:29,000 --> 00:05:31,000
+you are real Navin Reddy.
+
+147
+00:05:31,000 --> 00:05:32,000
+This is your session id.
+
+148
+00:05:32,000 --> 00:05:34,000
+And that goes on with the session
+
+149
+00:05:34,000 --> 00:05:35,000
+with the cookies in my machine.
+
+150
+00:05:35,000 --> 00:05:38,000
+And every time I go to a server, I can use that cookie.
+
+151
+00:05:38,000 --> 00:05:41,000
+I don't have to basically log in every time for every page.
+
+152
+00:05:41,000 --> 00:05:43,000
+Now that will be weird, right?
+
+153
+00:05:43,000 --> 00:05:44,000
+You go to, let's say you go to Facebook,
+
+154
+00:05:44,000 --> 00:05:48,000
+and every time you log in, not a good idea.
+
+155
+00:05:48,000 --> 00:05:49,000
+So what do you do?
+
+156
+00:05:49,000 --> 00:05:50,000
+So basically you have a session ID,
+
+157
+00:05:50,000 --> 00:05:52,000
+which you can use every time.
+
+158
+00:05:52,000 --> 00:05:53,000
+And in fact we have seen that
+
+159
+00:05:53,000 --> 00:05:55,000
+when you were talking about this being security,
+
+160
+00:05:55,000 --> 00:05:58,000
+we call it JSessionId and things were working out.
+
+161
+00:05:58,000 --> 00:06:00,000
+But what if you want to scale now?
+
+162
+00:06:00,000 --> 00:06:01,000
+What if you don't have one server,
+
+163
+00:06:01,000 --> 00:06:03,000
+you have multiple servers.
+
+164
+00:06:03,000 --> 00:06:06,000
+In that case, JSessionID will not work.
+
+165
+00:06:06,000 --> 00:06:08,000
+It's because the session ID is there with one server.
+
+166
+00:06:08,000 --> 00:06:11,000
+When you are scaling up, when you have a horizontal scaling,
+
+167
+00:06:11,000 --> 00:06:13,000
+you have multiple machines now.
+
+168
+00:06:13,000 --> 00:06:15,000
+In this case, what we can do is we can,
+
+169
+00:06:15,000 --> 00:06:18,000
+all these servers can share the same database
+
+170
+00:06:18,000 --> 00:06:21,000
+or maybe a cache where you can say, okay,
+
+171
+00:06:21,000 --> 00:06:23,000
+we have a session ID for this particular person.
+
+172
+00:06:23,000 --> 00:06:26,000
+Every time you get a request check in the shared database,
+
+173
+00:06:26,000 --> 00:06:29,000
+or maybe you can tell your load balances,
+
+174
+00:06:29,000 --> 00:06:30,000
+which are between your,
+
+175
+00:06:30,000 --> 00:06:33,000
+between you and your servers, that hey, you know,
+
+176
+00:06:33,000 --> 00:06:34,000
+every time you get a request from Navin,
+
+177
+00:06:34,000 --> 00:06:37,000
+send it to server one because server one knows who Navin is.
+
+178
+00:06:37,000 --> 00:06:39,000
+That's one of the solution.
+
+179
+00:06:39,000 --> 00:06:41,000
+But what if you don't do all those stuff
+
+180
+00:06:41,000 --> 00:06:44,000
+and every time a client goes to the server
+
+181
+00:06:44,000 --> 00:06:45,000
+and say login done,
+
+182
+00:06:45,000 --> 00:06:48,000
+after that, what if server can give you a pass,
+
+183
+00:06:48,000 --> 00:06:50,000
+the same pass, which I got in the coffee shop
+
+184
+00:06:50,000 --> 00:06:52,000
+and now every time you go to a server,
+
+185
+00:06:52,000 --> 00:06:54,000
+you can show this pass,
+
+186
+00:06:54,000 --> 00:06:56,000
+hey, I already paid $20 for the coffee.
+
+187
+00:06:56,000 --> 00:06:57,000
+Gimme my coffee for today.
+
+188
+00:06:57,000 --> 00:07:01,000
+That's one thing a client can do with that pass.
+
+189
+00:07:01,000 --> 00:07:04,000
+But of course we have to also sign the pass, right?
+
+190
+00:07:04,000 --> 00:07:07,000
+You don't want unsigned pass where anyone can use it.
+
+191
+00:07:07,000 --> 00:07:10,000
+And that's where to implement this coffee concept
+
+192
+00:07:10,000 --> 00:07:12,000
+or the subscription concept.
+
+193
+00:07:12,000 --> 00:07:14,000
+We have something called JWT,
+
+194
+00:07:14,000 --> 00:07:17,000
+which stands for JSON web tokens.
+
+195
+00:07:17,000 --> 00:07:18,000
+Basically the concept is about tokens
+
+196
+00:07:18,000 --> 00:07:21,000
+and another one of the way to implement that is JWT.
+
+197
+00:07:21,000 --> 00:07:25,000
+So what exactly JWT is and what are the options we have?
+
+198
+00:07:25,000 --> 00:07:27,000
+We'll see in the next video.
+

22 - JWT (JSON Web Token) and OAuth2/004 What is JWT_en.srt

@@ -0,0 +1,696 @@
+1
+00:00:00,000 --> 00:00:03,000
+(gentle music)
+
+2
+00:00:03,000 --> 00:00:04,000
+-: So what is JWT?
+
+3
+00:00:04,000 --> 00:00:07,000
+So JWT stands for JSON Web Token.
+
+4
+00:00:07,000 --> 00:00:11,000
+It's a open industry standard with RFC 7519,
+
+5
+00:00:11,000 --> 00:00:14,000
+and basically it is a way to transfer data
+
+6
+00:00:14,000 --> 00:00:16,000
+between two different parties, and that to securely.
+
+7
+00:00:16,000 --> 00:00:18,000
+Okay, now how it looks like.
+
+8
+00:00:18,000 --> 00:00:22,000
+See, whenever you send a token from a server to client,
+
+9
+00:00:22,000 --> 00:00:23,000
+it can be a normal XML as well,
+
+10
+00:00:23,000 --> 00:00:26,000
+so if you talk about technical world, not the coffee card.
+
+11
+00:00:26,000 --> 00:00:28,000
+So let's say if in the technical world,
+
+12
+00:00:28,000 --> 00:00:33,000
+you will be having this token a JSON data or XML data,
+
+13
+00:00:33,000 --> 00:00:36,000
+but in XML, the length of the data will be lengthy, right?
+
+14
+00:00:36,000 --> 00:00:38,000
+Even for the small amount of data,
+
+15
+00:00:38,000 --> 00:00:41,000
+you'll be having multiple tags and stuff,
+
+16
+00:00:41,000 --> 00:00:43,000
+plus encrypting it will be a different task.
+
+17
+00:00:43,000 --> 00:00:46,000
+The other way is you can use normal JSON,
+
+18
+00:00:46,000 --> 00:00:47,000
+but again, JSON will be lengthy as well.
+
+19
+00:00:47,000 --> 00:00:50,000
+In that case, we can use some encoded format,
+
+20
+00:00:50,000 --> 00:00:53,000
+and that's where the JSON web token comes to the picture.
+
+21
+00:00:53,000 --> 00:00:55,000
+Now this is the format I'm talking about.
+
+22
+00:00:55,000 --> 00:00:57,000
+So when you get a token from the server,
+
+23
+00:00:57,000 --> 00:00:58,000
+this is what you will get.
+
+24
+00:00:58,000 --> 00:01:02,000
+So this is alphanumeric values, but we can't read it
+
+25
+00:01:02,000 --> 00:01:04,000
+because this is in the encoded format.
+
+26
+00:01:04,000 --> 00:01:07,000
+So you can also decode this, and when you decode it,
+
+27
+00:01:07,000 --> 00:01:09,000
+you can see we have three sections here.
+
+28
+00:01:09,000 --> 00:01:10,000
+Now, before that,
+
+29
+00:01:10,000 --> 00:01:11,000
+you can see there's a section of algorithms.
+
+30
+00:01:11,000 --> 00:01:15,000
+So by the way, where I am now, I'm on jwt.io,
+
+31
+00:01:15,000 --> 00:01:17,000
+and you can see we can use different algorithms here.
+
+32
+00:01:17,000 --> 00:01:19,000
+Remember when I talked about the signature
+
+33
+00:01:19,000 --> 00:01:20,000
+or the encryption?
+
+34
+00:01:20,000 --> 00:01:23,000
+Basically we can use different algorithms here.
+
+35
+00:01:23,000 --> 00:01:23,000
+We have different options.
+
+36
+00:01:23,000 --> 00:01:28,000
+We got Hs, we got Rs, we got Es, and Ps.
+
+37
+00:01:28,000 --> 00:01:30,000
+Now basically we have,
+
+38
+00:01:30,000 --> 00:01:32,000
+remember when we talked about the asymmetric and symmetric?
+
+39
+00:01:32,000 --> 00:01:34,000
+So basically we have Hs here,
+
+40
+00:01:34,000 --> 00:01:38,000
+which is HMAC SHA-256, which is symmetric.
+
+41
+00:01:38,000 --> 00:01:41,000
+If you want to use asymmetric, we can also use Rs here,
+
+42
+00:01:41,000 --> 00:01:44,000
+and higher this numbers, it is better,
+
+43
+00:01:44,000 --> 00:01:45,000
+because you'll be having a bigger key.
+
+44
+00:01:45,000 --> 00:01:47,000
+Now here you can see we have three sections.
+
+45
+00:01:47,000 --> 00:01:49,000
+So each token will have three sections.
+
+46
+00:01:49,000 --> 00:01:51,000
+One is the header, one is a payload,
+
+47
+00:01:51,000 --> 00:01:53,000
+and next is the signature.
+
+48
+00:01:53,000 --> 00:01:55,000
+Now payload is very important here
+
+49
+00:01:55,000 --> 00:01:56,000
+because this is where you send your data.
+
+50
+00:01:56,000 --> 00:01:59,000
+So when you say a server's giving some token to the client,
+
+51
+00:01:59,000 --> 00:02:01,000
+with the information,
+
+52
+00:02:01,000 --> 00:02:03,000
+that information stays inside the payload.
+
+53
+00:02:03,000 --> 00:02:06,000
+Example, we got, who is subject the person?
+
+54
+00:02:06,000 --> 00:02:08,000
+So this is a subject,
+
+55
+00:02:08,000 --> 00:02:11,000
+a name, this, and the issuance time is this.
+
+56
+00:02:11,000 --> 00:02:14,000
+We can also set the expire time here if you want.
+
+57
+00:02:14,000 --> 00:02:19,000
+You can give a comma and you can say expiry,
+
+58
+00:02:19,000 --> 00:02:21,000
+and you can give a colon, and you can mention whatever time.
+
+59
+00:02:21,000 --> 00:02:24,000
+So maybe I want to use this time,
+
+60
+00:02:24,000 --> 00:02:25,000
+plus I want to change,
+
+61
+00:02:25,000 --> 00:02:28,000
+let's say I want to make this as 41.
+
+62
+00:02:28,000 --> 00:02:29,000
+So this is my expiration time,
+
+63
+00:02:29,000 --> 00:02:32,000
+and this should result some values.
+
+64
+00:02:32,000 --> 00:02:33,000
+So issuance is this.
+
+65
+00:02:33,000 --> 00:02:35,000
+This is a date for today, not today.
+
+66
+00:02:35,000 --> 00:02:39,000
+This is a date which is Jan 18th, 2018,
+
+67
+00:02:39,000 --> 00:02:42,000
+and 7:00 AM, looks like.
+
+68
+00:02:42,000 --> 00:02:46,000
+And if you look here, this is 7:30.
+
+69
+00:02:46,000 --> 00:02:48,000
+So we got this for 30 minutes, right?
+
+70
+00:02:48,000 --> 00:02:49,000
+The token.
+
+71
+00:02:49,000 --> 00:02:50,000
+Of course, the token will expire.
+
+72
+00:02:50,000 --> 00:02:52,000
+You can set the expire time here.
+
+73
+00:02:52,000 --> 00:02:54,000
+So this is your payload and you can send multiple data here.
+
+74
+00:02:54,000 --> 00:02:56,000
+It's not just you have to send only this.
+
+75
+00:02:56,000 --> 00:02:57,000
+We can add more data,
+
+76
+00:02:57,000 --> 00:03:02,000
+but trying to make payload as small as possible,
+
+77
+00:03:02,000 --> 00:03:03,000
+because you'll be sending this in the header,
+
+78
+00:03:03,000 --> 00:03:04,000
+and then there are some servers
+
+79
+00:03:04,000 --> 00:03:08,000
+which will not accept a bigger chunk of header.
+
+80
+00:03:08,000 --> 00:03:11,000
+So make sure that you don't put unnecessary stuff here.
+
+81
+00:03:11,000 --> 00:03:12,000
+Okay, now this is algorithm which we are using here,
+
+82
+00:03:12,000 --> 00:03:14,000
+which is HS226.
+
+83
+00:03:14,000 --> 00:03:15,000
+This is what you'll be having in the header.
+
+84
+00:03:15,000 --> 00:03:17,000
+You can change it and you can use some other algorithm.
+
+85
+00:03:17,000 --> 00:03:20,000
+Let's say if I want to use R, I can use that,
+
+86
+00:03:20,000 --> 00:03:21,000
+but let me stick to Hs here,
+
+87
+00:03:21,000 --> 00:03:25,000
+and then we are specifying the type of token,
+
+88
+00:03:25,000 --> 00:03:27,000
+which is JWT in this case.
+
+89
+00:03:27,000 --> 00:03:28,000
+Next we have a signature.
+
+90
+00:03:28,000 --> 00:03:30,000
+So when you say you want to sign it,
+
+91
+00:03:30,000 --> 00:03:31,000
+you have to use some signature,
+
+92
+00:03:31,000 --> 00:03:34,000
+and of course, you can use RSA
+
+93
+00:03:34,000 --> 00:03:34,000
+where you get two different signatures,
+
+94
+00:03:34,000 --> 00:03:36,000
+for private and public key,
+
+95
+00:03:36,000 --> 00:03:37,000
+but when you're using Hs,
+
+96
+00:03:37,000 --> 00:03:38,000
+you'll get only one secret key
+
+97
+00:03:38,000 --> 00:03:41,000
+which will be shared by client and server,
+
+98
+00:03:41,000 --> 00:03:43,000
+and you can encrypt it.
+
+99
+00:03:43,000 --> 00:03:45,000
+The problem is when you say encryption,
+
+100
+00:03:45,000 --> 00:03:48,000
+we are not achieving the actual encryption here.
+
+101
+00:03:48,000 --> 00:03:48,000
+We are just saying
+
+102
+00:03:48,000 --> 00:03:52,000
+that no one should be able to modify this token.
+
+103
+00:03:52,000 --> 00:03:54,000
+So example, if I got a token from the server,
+
+104
+00:03:54,000 --> 00:03:57,000
+no one else can hack my token and modify it,
+
+105
+00:03:57,000 --> 00:03:58,000
+because it is signed, right?
+
+106
+00:03:58,000 --> 00:04:00,000
+But what if you want to encrypt it?
+
+107
+00:04:00,000 --> 00:04:04,000
+So we also have an option of encrypting your JWT,
+
+108
+00:04:04,000 --> 00:04:06,000
+and by the default, we are not doing it here,
+
+109
+00:04:06,000 --> 00:04:08,000
+but we can encrypt it, and that's where.
+
+110
+00:04:08,000 --> 00:04:11,000
+When you are not encrypting your token,
+
+111
+00:04:11,000 --> 00:04:13,000
+that means anyone can see that.
+
+112
+00:04:13,000 --> 00:04:15,000
+That's right, anyone can see your data,
+
+113
+00:04:15,000 --> 00:04:19,000
+and that's why don't put secret data on in the payload.
+
+114
+00:04:19,000 --> 00:04:22,000
+Don't put your phone number or your Social Security number
+
+115
+00:04:22,000 --> 00:04:24,000
+or your bank password.
+
+116
+00:04:24,000 --> 00:04:26,000
+It should be only these details.
+
+117
+00:04:26,000 --> 00:04:28,000
+So that's basically JWT.
+
+118
+00:04:28,000 --> 00:04:30,000
+Now how we are going to implement this?
+
+119
+00:04:30,000 --> 00:04:32,000
+So if you want to implement this in your application,
+
+120
+00:04:32,000 --> 00:04:34,000
+so let's say we are going to build a very simple one
+
+121
+00:04:34,000 --> 00:04:37,000
+where a user sends a request to the server by saying,
+
+122
+00:04:37,000 --> 00:04:39,000
+I want to say hi,
+
+123
+00:04:39,000 --> 00:04:40,000
+and the server will say, "Welcome to Telusko."
+
+124
+00:04:40,000 --> 00:04:43,000
+That's it, a simple API, and I want to secure it.
+
+125
+00:04:43,000 --> 00:04:44,000
+Now how we are gonna do this?
+
+126
+00:04:44,000 --> 00:04:46,000
+First step,
+
+127
+00:04:46,000 --> 00:04:49,000
+a client will send the username and password to the server.
+
+128
+00:04:49,000 --> 00:04:51,000
+A server will say,
+
+129
+00:04:51,000 --> 00:04:52,000
+"Okay, I'm verifying the username and password,
+
+130
+00:04:52,000 --> 00:04:55,000
+which is correct, and now you are logged in."
+
+131
+00:04:55,000 --> 00:04:56,000
+Now once you are logged in,
+
+132
+00:04:56,000 --> 00:05:00,000
+the server will send a JWT token.
+
+133
+00:05:00,000 --> 00:05:02,000
+Now this token goes to the client,
+
+134
+00:05:02,000 --> 00:05:04,000
+and it's client's responsibility to save it now,
+
+135
+00:05:04,000 --> 00:05:07,000
+and next time when a client goes to the server, by saying,
+
+136
+00:05:07,000 --> 00:05:09,000
+"Hey, now I want sample predicted resource,"
+
+137
+00:05:09,000 --> 00:05:12,000
+maybe I want to say hi, or maybe I want to add two numbers,
+
+138
+00:05:12,000 --> 00:05:15,000
+whatever it can be, the server will say, "Who are you?"
+
+139
+00:05:15,000 --> 00:05:17,000
+Then you can say, "Okay, hold on."
+
+140
+00:05:17,000 --> 00:05:20,000
+When I'm sending a request, I have to also send the token.
+
+141
+00:05:20,000 --> 00:05:22,000
+The token goes to a server.
+
+142
+00:05:22,000 --> 00:05:23,000
+Server will say, "Okay, let me wait.
+
+143
+00:05:23,000 --> 00:05:25,000
+Let me verify your token first,"
+
+144
+00:05:25,000 --> 00:05:27,000
+and once the token is verified,
+
+145
+00:05:27,000 --> 00:05:31,000
+a server will be able to call the API
+
+146
+00:05:31,000 --> 00:05:33,000
+and send the response back.
+
+147
+00:05:33,000 --> 00:05:35,000
+That means every time you go to the server,
+
+148
+00:05:35,000 --> 00:05:38,000
+you have to take your token with you,
+
+149
+00:05:38,000 --> 00:05:41,000
+and of course, it should be done before it expires.
+
+150
+00:05:41,000 --> 00:05:43,000
+Now, if you want to implement this in your application,
+
+151
+00:05:43,000 --> 00:05:46,000
+we have to use some library for JWT,
+
+152
+00:05:46,000 --> 00:05:47,000
+and we are going to see that in the code.
+
+153
+00:05:47,000 --> 00:05:49,000
+And most of the things,
+
+154
+00:05:49,000 --> 00:05:52,000
+which will make sense in the code itself, don't worry.
+
+155
+00:05:52,000 --> 00:05:54,000
+But we have to add multiple mechanisms here.
+
+156
+00:05:54,000 --> 00:05:56,000
+First we have to have a library.
+
+157
+00:05:56,000 --> 00:05:59,000
+Now, using this library, you will be creating a token.
+
+158
+00:05:59,000 --> 00:06:01,000
+So of course, you have to do a login,
+
+159
+00:06:01,000 --> 00:06:03,000
+and once it is logged in, you have to create a token.
+
+160
+00:06:03,000 --> 00:06:06,000
+So you are responsible to create the token.
+
+161
+00:06:06,000 --> 00:06:08,000
+Next, you have to send this token to the client,
+
+162
+00:06:08,000 --> 00:06:11,000
+and when a client sends the next request,
+
+163
+00:06:11,000 --> 00:06:13,000
+a client will send a token,
+
+164
+00:06:13,000 --> 00:06:15,000
+and it is your job to verify the token.
+
+165
+00:06:15,000 --> 00:06:17,000
+So you have multiple steps to do,
+
+166
+00:06:17,000 --> 00:06:19,000
+and the upcoming code will not be that simple,
+
+167
+00:06:19,000 --> 00:06:20,000
+so just be with me.
+
+168
+00:06:20,000 --> 00:06:22,000
+I will try to make it simple,
+
+169
+00:06:22,000 --> 00:06:23,000
+but once you complete the entire code,
+
+170
+00:06:23,000 --> 00:06:26,000
+you can go through it and things will make sense.
+
+171
+00:06:26,000 --> 00:06:28,000
+So yeah, we have, we just have two tasks here,
+
+172
+00:06:28,000 --> 00:06:30,000
+create the token and verify the token,
+
+173
+00:06:30,000 --> 00:06:31,000
+and how do we do that?
+
+174
+00:06:31,000 --> 00:06:33,000
+That's in the practical videos.
+