Passport req.user not persisting across requests -

Question

Using passport.js local strategy I am trying to use the req.user to obtain current user id so that I can store recipes in the database with the users id. The problem seems to be around the deserialization part of the passport.js file I have in my config file in my app. Whenever I hit the /api/saveRecipe route for some reason it gets deserialized and the req user is then no longer available.

Notes: I am authenticating on my backend server using react on the front end.

Below is my server.js file

Problem: req.user is available after calling passport.authenticate('local') but once api/saveRecipe route is hit req.user is no longer available.

After researching this subject on S.O. it appears that it most often has to do with order in the server file setup but i have looked and reviewed and i believe my setup correct...

const express = require("express");
const bodyParser = require("body-parser");
const session = require("express-session");
const routes = require("./routes");

// Requiring passport as we've configured it
let passport = require("./config/passport");

const sequelize = require("sequelize");

// const routes = require("./routes");
const app = express();
var db = require("./models");
const PORT = process.env.PORT || 3001;

// Define middleware here
app.use(express.urlencoded({ extended: true }));
app.use(express.json());

// passport stuff
app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());
app.use(express.static("public"));

// We need to use sessions to keep track of our user's login status
// app.use(cookieParser('cookit'));
app.use(
  session({ 
    secret: "cookit", 
    name: "cookit_Cookie"
   })
);
app.use(passport.initialize());
app.use(passport.session());

// Serve up static assets (usually on heroku)
if (process.env.NODE_ENV === "production") {
  app.use(express.static("client/public"));
}

// the view files are JavaScript files, hence the extension
app.set('view engine', 'js');

// the directory containing the view files
app.set('pages', './');

// Add routes, both API and view
app.use(routes);

// Syncing our database and logging a message to the user upon success
db.connection.sync().then(function() {
  console.log("\nDB connected\n")
  // Start the API server
  app.listen(PORT, function() {
    console.log(`🌎  ==> API Server now listening on PORT ${PORT}!`);
  });
});
module.exports = app;

my passport.js code

//we import passport packages required for authentication
var passport = require("passport");
var LocalStrategy = require("passport-local").Strategy;
//
//We will need the models folder to check passport against
var db = require("../models");

// Telling passport we want to use a Local Strategy. In other words, we want login with a username/email and password
passport.use(
  new LocalStrategy(
    // Our user will sign in using an email, rather than a "username"
    {
      usernameField: "email",
      passwordField: "password",
      passReqToCallback: true
    },
    function(req, username, password, done) {
      // console.log(`loggin in with email: ${username} \n and password: ${password}`)
      // When a user tries to sign in this code runs
      db.User.findOne({
        where: {
          email: username
        }
      }).then(function(dbUser) {
        // console.log(dbUser)
        // If there's no user with the given email
        if (!dbUser) {
          return done(null, false, {
            message: "Incorrect email."
          });
        }
        // If there is a user with the given email, but the password the user gives us is incorrect
        else if (!dbUser.validPassword(password)) {
          return done(null, false, {
            message: "Incorrect password."
          });
        }
        // If none of the above, return the user
        return done(null, dbUser);
      });
    }
  )
);

// serialize determines what to store in the session data so we are storing email, ID and firstName
passport.serializeUser(function(user, done) {
  console.log(`\n\n        serializing ${user.id}\n`)
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  console.log(`\n\n        DEserializing ${id}\n`)
  db.User.findOne({where: {id:id}}, function(err, user) {
    done(err, user);
  });
});
// Exporting our configured passport
module.exports = passport;

const router = require("express").Router();
const controller = require("../../controllers/controller.js");
const passport = require("../../config/passport");

router.post(
  "/login",
  passport.authenticate("local", { failureRedirect: "/login" }),
  function(req, res) {
    console.log(`req body -${req.body}`);
    res.json({
      message: "user authenticated",
    });
  }
);


router.post("/saveRecipe", (req, res) => {
  console.log(req.user)
  if (req.isAuthenticated()) {
    controller.saveRecipe;
  } else {
    res.json({ message: "user not signed in" });
  }
});

module.exports = router;

Answer 1

The problem is in your router.post('login'). Try changing it to something like this:

  app.post('/login', passport.authenticate('local-login', {
    successRedirect: '/profile',
    failureRedirect: '/login/failed'})
  )

This will correctly set the req.user in your next requests!