isAuthenticated() in Passport js always return false

Question

I have been browsing the forum but I am unable to find the error in my code , it always results in false and I am not able to solve it , Please help me... Is there any other way to authenticate user instead of passport so that I can use it.I am adding more sentences as it is not allowing me to post my query,Sorry..

const http = require("http"),
  hostname = "127.0.0.1",
  port = 3000,
  bodyParser = require("body-parser"),
  mongoose = require("mongoose"),
  express = require("express"),
  passport = require("passport"),
  localStrategy = require("passport-local"),
  passportLocalMongoose = require("passport-local-mongoose"),
  User = require("./models/user");
app = express();
mongoose.connect("mongodb://localhost/drive", { useNewUrlParser: true });
app.set("view engine", "ejs");
app.use(express.static("public"));
app.use(passport.initialize());
app.use(passport.session());
app.use(
  require("express-session")({
    secret: "Beta tumse na ho payega",
    resave: false,
    saveUninitialized: false
  })
);
passport.use(new localStrategy(User.authenticate()));
passport.serializeUser(User.serializeUser());
passport.deserializeUser(User.deserializeUser());
app.use(bodyParser.urlencoded({ extended: true }));
const server = http.createServer((req, res) => {
  res.statusCode = 200;
  res.setHeader("Content-Type", "text/plain");
});
app.get("/", function(req, res) {
  res.render("index");
});
app.get("/register", function(req, res) {
  res.send("hello");
});
app.get("/login", function(req, res) {
  res.render("login");
});
app.post(
  "/login",
  passport.authenticate("local", {
    successRedirect: "/",
    failureRedirect: "/login"
  }),
  function(req, res) {}
);

app.get("/logout", function(req, res) {
  req.logout();
  res.redirect("/");
});

function isLoggedIn(req, res, next) {
  if (req.isAuthenticated()) {
    return next();
  } else {
    console.log("Not logged");
    res.redirect("/login");
  }
}
app.get("/secret", isLoggedIn, function(req, res) {
  res.send("You are logged in");
});
app.post("/register", function(req, res) {
  if (req.body.password === req.body.cpassword) {
    User.register(
      new User({ username: req.body.username }),
      req.body.password,
      function(err, user) {
        if (err) console.log(err);
        else
          passport.authenticate("local")(req, res, function() {
            res.send("signed up");
          });
      }
    );
  } else res.send("Password Mismatch");
});
//DRIVE SCHEMA
//var driveSchema = mongoose.Schema({
//  title: String,
//  created: { type: Date, default: Date.now }
//});
app.listen(port, hostname, function() {
  console.log("Server is running at " + hostname + "/" + port);
});

//./models/user.js  file

const mongoose = require("mongoose"),
  passportLocalMongoose = require("passport-local-mongoose");
var UserSchema = new mongoose.Schema({
  username: String,
  password: String
});
UserSchema.plugin(passportLocalMongoose);
module.exports = mongoose.model("User", UserSchema);

Answer 1

I have used passport and jwt library, to authenticate and maintain session for the user. There is no need to maintain user session on server side.

apis/apis.js : This file has all apis end points. /login url will authenticate user using passport and send a token to the client using jwt

const passport = require('passport')
const expRoute = require('express').Router();
let exporter = process.exporter;
expRoute.post('/login', (req, res, next) => {
  passport.authenticate(
    'local', 
    { 
        // successRedirect: '/',
        // failureRedirect: '/login',
        successFlash: 'Welcome!',
        failureFlash: 'Invalid username or password.' 
    },
    (err, user, info) => {
        if (err) {
            return res.status(500).json(err)
        }
        else if (user) {
            return res.status(200).json({
                token: exporter.generateToken(user)
            })
        }
        else {
            return res.status(400).json(info)
        }
    }
  )(req, res, next);
})
expRoute.get('/view', exporter.authenticateToken, (req, res) => {
    let param = req.finalTokenExtractedData
    if (param && exporter.isObjectValid(param, 'tokenId', true, true)) {
        let condition = {
            _id: param.tokenId
        }
        let options = {
            _id: 0,
            password: 0,
            __v: 0
        }
        process.USER.findOne(condition, options) // mongo find
        .then((data) => {
            res.status(200).json({
                 result: data,
                 msg: 'success'
            })
        })
       .catch((mongoErr) => {
            exporter.logNow(`USER mongo Error: ${mongoErr}`)
            res.status(400).json({
                msg: 'user not found'
            })
        })
    }
    else {
        res.status(404).json({
            msg: 'invalid token'
        })
    }
})
module.exports = expRoute

common/env.js: This file will initialise all connections such mongo, require few files will be used as global

process.CONFIG = require('../configs/config.json')

process.exporter = require("../lib/exporter.js")

process.dbInit = (globalName, mongoUrl, collectionName) => {
    require("../models/db-init.js")(mongoUrl, collectionName)
    .then((modelObj) => {
        process[globalName] = modelObj // will be used as global
    })
    .catch((dbInitErr) => {
        process.exporter.logNow(`dbInit Error: ${dbInitErr}`)
        process.exit()
    });
}

lib/exporter.js: This file has exporter class which consist of all major functions like mongo connection, authenticateToken, verifyPassword, etc.

const fs = require('fs'),
    redis = require("redis"),
    path = require("path"),
    mongoose = require('mongoose'); mongoose.set('useCreateIndex', true);
const Schema = mongoose.Schema;
var bcrypt = require('bcryptjs')
var jwt = require('jsonwebtoken')

class Exporter  {
    mongoConnection(mongoURI, schemaObj) {
        return new Promise(async (resolve, reject) => {
            if (!mongoURI || typeof mongoURI == 'undefined' || mongoURI.length < 1)
                return reject('invalid mongo connection url');
            return resolve(mongoose.createConnection(mongoURI, { useNewUrlParser: true }))
        })
    }
    createMongoSchema(schemaObj) {
        return (new Schema(schemaObj));
    }
    createMongoModel(mongoDB, collectionName, newSchema) {
        if (newSchema)
            return mongoDB.model(collectionName, newSchema)        
        return mongoDB.model(collectionName)
    }
    authenticateToken(req, res, next) {
        const bearerHeader = req.header('authorization')
        if (typeof bearerHeader != 'undefined') {
            const bearer = bearerHeader.split(' ')
            const bearerToken = bearer[1] 
            jwt.verify(bearerToken, process.CONFIG.jwt.token.activated, (err, data) => {
                if (err)
                    res.status(400).json({
                        msg: "Invalid token or please try to login again"
                    })
                else {
                    process.exporter.getSingleHashKeysValuesFromRedis('expired_token', bearerToken)
                    .then((redisTokendata) => {
                        if (redisTokendata)
                            res.status(400).json({
                                msg: "token expired"
                            })
                        else {
                            req.finalTokenExtractedData = data
                            // if (req.originalUrl.trim() == process.logoutURL.trim())
                                req.jwtToken = {
                                    token: bearerToken,
                                    secret: process.CONFIG.jwt.token.activated
                                }
                            next()
                        }
                    })
                    .catch((redisTokenError) => {
                        process.exporter.logNow(`redis token error: ${redisTokenError}`)
                        res.status(400).json({
                            msg: "Some went wrong while checking token. Please try later."
                        })
                    })
                }
            })
        }
        else 
            res.status(400).json({
                msg: "invalid token"
            })
    }
    generateToken(data) {
        let expiry = new Date();
        // expiry.setDate(expiry.getDate() + 7)
        expiry.setMinutes(expiry.getMinutes() + 5)
        return jwt.sign({
            tokenId: data._id,
            exp: parseInt(expiry.getTime() / 1000),
        }, process.CONFIG.jwt.token.activated)
    }    
    createPassword(password) {
        return new Promise((resolve, reject) => {
            if (typeof password == 'undefined' && password == '')
                return reject('password empty')
            bcrypt.hash(password, 10, async (bErr, hash) => {
                if (bErr)
                    reject(bErr)
                else
                    resolve(hash)
            })
        })
    }
    verifyPassword(enteredPassword, savePassword) {
        return bcrypt.compareSync(enteredPassword, savePassword)
    }
}
module.exports = (new Exporter());

index.js: This is file which you will execute node index.js.

const express = require('express');
const path = require('path');
const bodyParser = require('body-parser');
const passport = require('passport');

require('./common/env')
require('./configs/passport')

const app = express()

const cors = require('cors')
app.use(cors());
app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true}))
app.use(passport.initialize())

app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
});

let apis = require('./apis/api')
app.use('/user', apis)

/**
 * 404 Handler
 */
app.use((req, res, next)=>{
    return res.status(404).send("Endpoint "+req.url +" not found");
})

/**
 * if any error or exception occurred then write into a JS file so that app can be restarted
 */
process.on('uncaughtException', (err) => {
    console.error(err.stack);
});


app.listen(3000, function(server) {
    console.log("App listening at 3000");
});

When index.js file has been executed successfully and listening to a port 3000, then use this URL http://localhost:3000/user/login for authentication, it will accept your username and password, then authenticate using passport and send a token to the client as response. The token can contain user data in encrypted form and have expiry time.

Reference link: https://github.com/arjun-707/login-logout-jwt-nodejs

Answer 2

You need the express-session module.

server.js

// Require a possible config.js file with your configuration variables
const Config = require('./models/config.js');
// If the config module is formed as a class
const config = new Config();
const express = new('express');
const app = express();

const session = require('express-session');
const MongoStore = require('connect-mongo')(session);
const uuid = require('uuid/v4');
const mongoose = require('mongoose');
// Require your custom passport local strategy file
const passport = require('./models/sessions');

mongoose.connect('mongodb://localhost:27017/your_db_name', {
    useNewUrlParser: true
});

// Set the session options
app.use(session({
    // Use UUIDs for session IDs
    genid: (req) => {
        return uuid()
    },
    // If you want to store the session in MongoDB using mongoose
    // Require your personal mon
    store: new MongoStore({
        mongooseConnection: mongoose.connection
    }),
    // Define the session secret in env variable or in config file
    secret: process.env.SESSION_SECRET || config.sessionSecretKey,
    resave: false,
    saveUninitialized: true
}));
// Initialize the passport module
app.use(passport.initialize());
// Tell to passport to use session
app.use(passport.session());

./models/session.js

const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;
const bcrypt = require('bcrypt-nodejs');
// Your custom MongoDB connection module
const db = require('./db');

// Configure passport.js to use the local strategy
passport.use(new LocalStrategy({
        usernameField: 'username'
    },
    (username, password, done) => {
        db.User.find({
            username: username // But it could use email as well
        }).then(res => {
            const user = JSON.parse(JSON.stringify(res[0]));
            if (!user) {
                return done(null, false, {
                    message: 'Invalid credentials.\n'
                });
            }
            if (!bcrypt.compareSync(password, user.password)) {
                return done(null, false, {
                    message: 'Invalid credentials.\n'
                });
            }
            return done(null, user);
        }).catch(error => done(error));
    }
));

// Tell passport how to serialize the user
passport.serializeUser((user, done) => {
    done(null, user._id);
});

// Tell passport how to deserialize the user
passport.deserializeUser((id, done) => {
    db.User.find({
        _id: id
    }).then(res => {
        const response = typeof res !== undefined && res.length != 0 ? JSON.parse(JSON.stringify(res[0])) : null;
        done(null, response)
    }).catch(error => done(error, false))
});

// Export passport for external usage
module.exports = passport;

./models/db.js

const mongoose = require('mongoose');
const Schema = mongoose.Schema;
const uuid = require('uuid/v4');

// Connect to MongoDB
mongoose.connect('mongodb://localhost:27017/your_db_name', {
    useNewUrlParser: true
});

// Define the models container
let models = {};

// Prepare your user schema
const userSchema = Schema({
    username: {
      type: String,
      required: true
    },
    password: {
      type: String,
      required: true
    }
});

// Assign the user schema
models.User = mongoose.model('User', userSchema);

// Export for external usage
module.exports = models;

/*
In that way you can wrap in "models" all schemas:

const newSchema = Schema({
  name: String
});
models.Newschema = mongoose.model('Newschema', newSchema);

module.exports = models;

And use it externally like:

const db = require('./models/db');

db.User.find({}).then(docs => {}).catch(err => {});
db.Newschema.find({}).then(docs => {}).catch(err => {});

Etc....

*/

./models/config.js

class Config {
  
  constructor() {
    this.sessionSecretKey = "my-awesome-secretkey";
    /* And other configurations */
  }

}

module.exports = Config;

/*

Externally use like:

const Config = require('./models/config');
const config = new Config();

let sessionSecretKey = config.sessionSecretKey;

*/

Then you can use the req.isAuthenticated() after the login:

// POST the username and password to '/login' router
app.post('/login', (req, res, next) => {
    passport.authenticate('local', (err, user, info) => {
        if (info) {
            return res.send(info.message)
        }
        if (err) {
            return next(err);
        }
        if (!user) {
            return res.sendStatus(404); // Is a shortcut
            // OR -> res.status(404).end();
            // OR -> res.status(404).send('Not found'); as you like
        }
        req.login(user, (err) => {
            if (err) return next(err);
            // Store the user object retrieved from MongoDB in `req.session`
            req.session.user = user;
            return res.sendStatus(200); // Is a shortcut
            // OR -> res.status(200).end();
            // OR -> res.status(200).send('OK'); as you like
        })
    })(req, res, next);
});

// The logout logic
app.get('/logout', verifySession, function (req, res) {
    req.session.destroy(function (err) {
        req.logout();
        res.redirect('/');
    });
});

// Verify the session to protect private routers
function verifySession(req, res, next) {
    if (req.isAuthenticated()) {
        next();
    } else {
        // Forbidden
        res.redirect('/');
        // OR -> res.sendStatus(403);
        // OR -> res.status(403).end();
        // OR -> res.status(403).send('Forbidden'); as you like
    }
}

Of course you have to run npm install with all the dependencies required defined in package.json file or manually instal with npm i express-session@latest --s for all the dependencies required: npm i module-name@latest --s.

Don't forget the

const server = app.listen(config.port || 3000, () => {
    console.log(`Server running on ${server.address().port} port.`);
});

At the end of server.js file. I hope that it will be useful for you.