How to pass jwt token from one route to another - node.js

Question

I have two routes in my node js app: users & records
In the users route I am getting the token on /login path:
users.post('/login', function(req, res) {
const email = req.body.email;
const password = req.body.password;
var token = '';
connection.query(`SELECT * FROM ${process.env.USER_TBL} WHERE EMAIL = ?`, [email], function(err, results, fields) {
if (err) {
res.status(200).json({'message' : err, 'token' : token})
}
if (results.length > 0) {
bcrypt.compare(password, results[0].PASSWORD).then(function(match) {
if (match == true) {
token = jwt.sign(JSON.parse(JSON.stringify(results[0])), process.env.SECRET_KEY, {
expiresIn: 5000
})
res.status(200).json({'message' : 'User verified', 'token' : token})
} else {
res.status(200).json({'message' : 'Email or Password does not match', 'token' : token})
}
})
} else {
res.status(200).json({'message' : 'Email does not exists', 'token' : token})
}
})
connection.end(err => {
if(err) console.log(err);
})
})
In my second route records I am making a request to path /addNewRecord,
records.post('/addNewRecord', function(req, res) {
//need the token to authenticate the request
});
here I need the token generated from /login route to send in the hrader and authenticate my request.
but I am understand how can I pass token value from users route to records route.

Answer 1

When you login you transmit your token to the user, capture that token and put it into local storage on the client. Then it available for the next call to the server.
localstorage.setItem('token', token)
When making your next server request you would use the stored token in your header.
$.ajax({
url: "URL",
method: "POST",
headers: {
'authorization': localstorage.getItem('token'), //YOUR TOKEN GOES HERE
'anotherHeader': 'headerValue2'
}
});
Then you can capture the token from the next request to verify it is valid
records.post('/addNewRecord', function(req, res) {
let token = req.headers['authorization']
});

Answer 2

You can't pass a token between server side code in that manner. It has to be sent from the client. Whenever /login is called from the client side and it receives a response, you can then store the token from that response on the client side. When calling /addNewRecord simply add the token in the header of the request on the client side and it can be accessed by inspecting req.get(headerName) or req.headers on the server side.