04 - Get Items From One User
In this module, we'll add a client method for making an authenticated request with a token to an authenticated route.
Authenticated Request Defined
Authentication is the process of identifying whether a client is eligible to access a resource. An authenticated request usually means that a client has some token or cookie allowing access to a resource. Hence, for clarity in this book, we'll refer to Authenticated Requests as being synonmous with a user that has a token. Think of it as a user that is logged in.
Auth Test
Let's add a 03-auth-test.js
file inside of the client folder:
We'll add all of our authenticated request logic in there.
We'll also need to add the script tag to the bottom of the index.html
file:
Code
Add the following code to 03-auth-test.js
:
Analysis
Since we stored our token in
localStorage
, we can access it by using thegetItem
method to get it back from localStorage and put it in a variable. Note that we could also use ourgetSessionToken()
method for this task.By default,
fetch
runs aGET
request. We can use themethod
property to send other requests. In this case, we're still sending aGET
.The
Content-Type
header tells the server what kind of data is being sent in our PreFlight request, if any.The
Authorization
header provides some sort of encrypted data allowing access to the server, in this case our token.
Test
Make sure both the server and client are running.
Open the console.
Go to Step 9.
Press the button.
You should see an error similar to the following image:
The problem isn't with our code here. The problem lies with a file on the server side: the validate-session.js
file, and specifically how that file handles the pre-flight OPTIONS
request sent by our browser.
Small Refractor to validate-session.js
validate-session.js
As a reminder, here is the validate-session
function:
Notice the parts that are commented out: the if
statement at the top and the corresponding else
. When we used Postman to test, we never sent an OPTIONS
request. Here is the result of that request:
You can see that there isn't an Authorization
header on that request, so when validate-session
looks for req.headers.authorization
, it comes back undefined, breaking the rest of the function. That's where this conditional comes into play. One of the properties on fetch
is method
; This is where we tell fetch what type HTTP request to send (GET
, POST
, etc.). This conditional allows us to tell the program to let any request where req.method
is OPTIONS
through without checking for a session token. This way the pre-flight check can occur, then the program will look for and verify a token on any other request.
Un-comment the if/else
statement at the top, as well as the closing curly bracket at the bottom, then run the test above again. It should go through this time. However, since you've just created your user, you will probably see an empty array. This is coming from the Postgres table:
Last updated