Passport login and persisting session
<h1>Background</h1>

<p>I have a MEAN application with CRUD capabilities fully tested with postman. I have been trying to persist login for quite some time now with no luck. I have read and tried the following </p>

<ul>
<li><a href="http://passportjs.org/">passport docs</a></li>
<li><a href="http://toon.io/understanding-passportjs-authentication-flow/">toon io's blog about login</a></li>
<li><a href="https://www.npmjs.com/package/express-session">Express session</a></li>
<li><a href="https://scotch.io/tutorials/easy-node-authentication-setup-and-local">Scotch io, node auth made easy</a></li>
<li>Plus a buch of other light reading materials (Lots of SO questions)</li>
</ul>

<p>But I have only been able to register and log a user in, not persist login with a session.</p>

<h1>My App</h1>

<p><a href="https://github.com/joeLloyd/MEANBoilerPlate">Here</a> is a link to the full github repo (if you are looking for the latest changes check develop branch)</p>

<h1>My Understanding of Auth/Login</h1>

<p>Here is my understanding of user login with code examples from my project and screenshot of postman results as well as console logs.</p>

<h3>Passport setup</h3>

<p>I have the following auth.js file, it configs passport</p>

<pre><code>var passport = require('passport');
var LocalStrategy = require('passport-local').Strategy;

module.exports = function(app, user){

  app.use(passport.initialize());
  app.use(passport.session());

  // passport config
  passport.use(new LocalStrategy(user.authenticate()));

  passport.serializeUser(function(user, done) {
    console.log('serializing user: ');
    console.log(user);
    done(null, user._id);
  });

  passport.deserializeUser(function(id, done) {
    user.findById(id, function(err, user) {
      console.log('no im not serial');
      done(err, user);
    });
  });
};
</code></pre>

<p>This gets called in the server file like</p>

<pre><code>//code before
var user    = require('./models/user.js');
var auth    = require('./modules/auth.js')(app, user);
// code after
</code></pre>

<h3>Routing for login</h3>

<p>In my routes I have the login route as follows</p>

<pre><code>router.post('/login', function(req, res, next) {

  passport.authenticate('local', function(err, user, info) {

    if (err) {
        return next(err);
    }

    if (!user) {
        return res.status(401).json({
            err: info
        });
    }

    req.logIn(user, function(err) {

        if (err) {
            return res.status(500).json({
                err: 'Could not log in user'
            });
        }

        res.status(200).json({
            status: 'Login successful!'
        });

    });
  })(req, res, next);
});
</code></pre>

<p>This route <strong>works</strong> as tested with postman. I enter the details 'joe' and 'pass' and get the following response.</p>

<p><a href="https://i.stack.imgur.com/pHyFx.png"><img src="https://i.stack.imgur.com/pHyFx.png" alt="enter image description here"></a></p>

<p>When this route is hit we can also see in the console that the user is serialized.</p>

<p><a href="https://i.stack.imgur.com/edlc4.png"><img src="https://i.stack.imgur.com/edlc4.png" alt="enter image description here"></a> </p>

<h1>So what next?</h1>

<p>This is where I get lost. I have a few questions.</p>

<ol>
<li>Is the user now in a session on my server?</li>
<li>Should I send the <code>req.session.passport.user</code> back to the client?</li>
<li>Do I need the session ID on all future requests?</li>
</ol>

<h1>Testing the Session</h1>

<p>I have a second route setup for testing the session it is as follows</p>

<pre><code>router.get('/checkauth', passport.authenticate('local'), function(req, res){

    res.status(200).json({
        status: 'Login successful!'
    });

});
</code></pre>

<p>The part <code>passport.authenticate('local')</code> (I thought) is there to test if the user session exists before giving access to the route but I never get a 200 response when I run this, even after a login.</p>

<p>Does this route expect a <code>req.session.passport.user</code> passed in the head or as a data argument on a http request that requires auth?</p>

<p>If I missed anything or am understanding something wrong please tell me, any input is appreciated. Thanks all.</p>