So now that we have the middleware in place on the front end to check authentication, it's time to
modify what happens when a user logs in because we're checking for a value in the session, but we're
never putting anything there.
So let's go back to our I.T. and let's open up the login page, go HTML right there and we'll find the
actual form.
Now, that form has an idea of login form, but it has no action and we're going to give it an action
will point to a route that doesn't exist yet and it's post login.
So we already have a route for get log in the displays.
This page now we need to build one that actually posts and of course that means we need to come down
here on the VAL method and write down here.
We're not going to code location H ref.
We'll get rid of that.
And instead we'll submit that formal document Dockett Element by ID and it's called Log in lowercase
log in underscore form.
We want to submit it.
So we need to now go to our roots file for the front end and find that log in root right here.
This is the GETRUDE.
Let's just duplicate that and make it a post route
and we'll point to a handler that doesn't exist yet.
Login page will call it say log post, login page.
OK, now let's go to our handlers.
So that's in our handlers thought go file and we'll create a route to handle the post login func receiver
of pointer to application.
We'll call this post login page again, get a handler.
So W response writer and our pointer to a request.
Now what's going to happen in here is first of all, we're going to do something that you should do
any time someone logs in or log out and that's regenerate or renew your token in the session.
So that's really easy to do.
We have access to the session in our app variable and we're just going to call renew tokens right there.
And all it takes is one parameter and that's the context.
And that's just good practice.
You can do this without doing that.
But this is a good idea from a security point of view.
Now we need to pass the form so there is a sign the value of our passport and we check for an error.
If error is not equal to nil, then you can do whatever you want.
I'm just going to leave the error after error log dot print line and I'll print the error and just return.
And of course you can do whatever you want in there.
Now we'll get our two values, which are email, which comes from hard up form dot get and we call that
email all lowercase and password is our form douget password.
Now at this point what we want to do is query the database and do a comparison between the password
that they've supplied, which is a test password and the hash that we have stored in the database.
So in order to do that, we need to go over to our models.
Don't go.
So let's go there and go to the very bottom and I'll create a new function here and it's similar to
me.
Create the function description first and DB model and we'll call this just authenticate and it will
take two parameters, which will be the email and the password, which we get from the form both in
the form of strings.
And we're going to return an end, potentially an error now as I usually do.
Let's go copy our contact stuff from the function right above it.
So I don't mistype that and paste it in.
And let's create two variables ver ID, which is an end and that's where will store the user ID if we
can get the user from the database and our hashed password, which is the hash hashed password that's
stored in the database and we'll use that for a comparison.
So now let's try to get a user so we'll create a row.
That's our variable and that's assign the value of amd, db query row context and add the context and
add a query which is nothing more sophisticated than select ID and password from users where email equals
questionmark.
And our substitution is email, we're looking up, a user are trying to.
So let's see if there's an error error as a sign the value of Rodust scam.
And we're going to scan into ID and hashed password.
If there's an error, if error is not equal to nil, then we'll return it and the error, otherwise
we found a user.
Now we need to compare their password.
And the way that this happens is very similar to the way we're looking for valid tokens on the back
end.
So we're going to look for an error error as a sign the value of from from the decrypt package right
there, BCR, why we're going to call COMPAR hash and password and we're going to compare a slice of
bytes.
And the first value is the hashed password and the second value is byte.
The password that the user typed in.
So at this point, we check for an error if error in the first case, I'll look for if it's exactly
equal to decrypt, dot or mismatched hash and password, then will return zero because we don't have
a user and errors dot new.
And I'm going to just say incorrect password.
OK,
now if it's not that kind of error else, but it is error.
So else if error is not equal to nil, you have to do that and we want to return just zero and whatever
the error was, otherwise we'll return the ID.
We found a matching user, no error.
The user exists and the password matches.
So now let's go back to handlers.
We'll just make this really simple.
So look for any potentially error.
And they come from after DB authenticate and we handed email and password if error is not equal to nil.
Now, at this point, you could store an error message in the session, check for the existence of that
on your login page and display the error message.
But I'm just going to do a redirect right now, redirect.
And we're going to redirect our back to the login page with no message whatsoever, which isn't very
friendly.
But it's easy enough for you to add that.
And I'll just go status to see other.
And we'll return,
otherwise they actually logged in, so now we put that idea in session after session, not put, which
is a method not pop put, which is one available to us right from the session's package.
And it requires the context
and it requires something to call that.
And if you recall in the middle where I called it user I.D., exactly like that.
And we'll put the idea in there and I will read to the homepage http redirect
or go to the homepage http dot status, see other.
So that should actually take care of it.
So let's stop our application of it's running mate.
Stop, start.
Let's go back to our Web browser, reload this page, you can see that I'm not logged in because it
says log in up here.
So let me logging that example dot com and I'll put the wrong password in.
And I should just bring me right back to this page.
And it does good.
OK, so we have invalid authentication credentials, and that's, of course, from the back end and
not from the front end, but it doesn't matter.
Now, we'll put a valid password in there, which happens to be password all lowercase.
And if I typed out correctly.
I get taken to the homepage now, I should be able to go to the virtual terminal page because I have
that value in my session and I can't perfect.
So the next step is to actually implement the logout logic.
Now, you might think it works and it certainly looks like it does.
But at this point, I still have that user ID in my session and I need to get it out of there when we
log out.
So we'll take care of that in the next lecture.