Git for Version Control

Why Git?

• Git :most commonly used software for tracking changes in any set of files, usually used for coordinating work among programmers collaboratively developing source code during software development.
• Git has many advantages over earlier systems such as CVS and Subversion

Adding a file to git repository

• $git checkout feature
• $ git status
• $ git add filename or . – add all or git commit –am “message”
• $ git status
• $ git commit -m “Implemented …“
• $ git push feature

Adding Multimpule files…

Git flow

How it works?

Feature branches

Release branches

Hotfix branches

JWT

Structure JWT

• Step 1. Create a Header

The JWT header contains information about how the JWT signature should be calculated. The header is also a JSON object that looks like this:

The typ field doesn't tell us anything new, only that it's a JSON Web Token. More interesting here is the alg field, which defines the hashing algorithm. It will be used when creating the signature. HS256 is nothing but HMAC-SHA256 and only needs one secret key to compute it (more on that in step 3). Another RS256 algorithm can also be used - unlike the previous one, it is asymmetric and creates two keys: public and private. The private key creates a signature, while the public key only verifies the authenticity of the signature, so we don't have to worry about its security.

Step 2. Create PAYLOAD

• Step 2. Create PAYLOAD
Payload is the payload that is stored inside the JWT. This data is also called JWT-claims. In the example we are considering, the authentication server creates a JWT with information about the user id - userId.

We put only one claim in payload. You can submit as many entries as you like. There is a list of standard claims for JWT payload - here are some of them:

• iss (issuer) - Identifies the application from which the token is being sent.
• sub (subject) - defines the subject of the token.
• exp (expiration time) — token lifetime.
But it is worth remembering that the more information is transmitted, the larger the JWT itself will end up. This is usually not a problem, but it can still negatively affect performance and cause delays in communication with the server.

Step 3. Create SIGNATURE

• Step 3. Create SIGNATURE
The base64url algorithm encodes the header and payload created in steps 1 and 2. The algorithm connects the encoded strings through a dot. Then the resulting string is hashed by the algorithm specified in the header based on our secret key.

Types of tokens

• Access tokens are usually short-lived JWTs signed by the server. They are included in every HTTP request made by the client to the server. Tokens are used to authorize requests.
• Refresh tokens are typically long-lived tokens stored in a database and used to obtain a new access token when the previous token expires.

Refresh Tokens

Understanding how client-side refresh token works

• First of all, we need to know how the refresh token strategy will work in our SPA application.
• After the user logs into our application, our API will return an object containing the AccessToken, RefreshToken, and UserInfo.
• AccessToken and RefreshToken will be saved in LocalStorage and at each request for a new endpoint with access protection only for authenticated users, for example, the user data display route, AccessToken will be added in the header of this request.
• Using the Axios library to perform these requests, we have a method called interceptor. This method allows us to intercept our request or response before our data is processed, making it possible to check if our AccessToken has expired and sent a new request to gain access to our request route that we want to access.

Storage of tokens