Passport is not serializing my user in login - passport.js

Question

I am practicing of using passport.js for authentication but there is a problem in login part. I've tried to solve the problem by different way but nothing was successful, the problem is even after changing the passport.serialize to (user, done) the code worked but if I enter any fake password and username, it authenticate me.
How do I solve it?
// npm i passport passport-local passport-local-mongoose express-session
const express = require("express");
const app = express();
const bodyParser = require("body-parser");
app.use(express.urlencoded({ extended: false }));
app.use(express.static("public"));
const session = require("express-session"); // session first
const passport = require("passport"); //then passport
const passportLocalMongoose = require("passport-local-mongoose"); // last passport-local-mongoose
// no need to passport-local
app.use(session({ // use the session first and set it up
secret: "this is our secrete",
resave: false,
saveUninitialized: false
}));
app.use(passport.initialize()); // then use passport to initialize
app.use(passport.session()); // then use passport to deal with session
const mongoose = require("mongoose");
mongoose.connect("mongodb://localhost:27017/authentication", { useNewUrlParser: true, useUnifiedTopology: true })
mongoose.set("useCreateIndex", true); // to prevent the deprecation message
const authSchema = new mongoose.Schema({
email: String,
password: String
})
authSchema.plugin(passportLocalMongoose); //plug passportLocalMongoose in the schema
const Auth = new mongoose.model("Auth", authSchema);
passport.use(Auth.createStrategy());
passport.serializeUser(Auth.serializeUser()); // put a message in a cookie
passport.deserializeUser(Auth.deserializeUser()); // destroy the cookie and reveal the message
app.get("/", (req, res) => {
res.sendFile(__dirname + "/index.html");
})
app.get("/register", (req, res) => {
res.sendFile(__dirname + "/register.html");
})
app.get("/login", (req, res) => {
res.sendFile(__dirname + "/login.html");
})
app.get("/success", (req, res) => {
res.sendFile(__dirname + "/success.html");
})
app.get("/secret", (req, res) => {
console.log(req.isAuthenticated());
if (req.isAuthenticated()) {
res.sendFile(__dirname + "/secret.html")
} else {
res.sendFile(__dirname + "/login.html")
}
})
app.post("/register", (req, res) => {
var regEmail = req.body.email;
var regPassword1 = req.body.password1;
var regPassword2 = req.body.password2;
if (regPassword1 === regPassword2) {
Auth.register({ username: regEmail }, regPassword1, (err, user) => {
if (err) throw err;
passport.authenticate('local')
res.redirect("/success")
})
}
})
app.post("/login", (req, res) => {
const user = new Auth({
email: req.body.email,
password: req.body.password
});
req.login(user, (err) => {
if (err) throw err;
passport.authenticate("local")
res.redirect("/secret")
})
})
var port = 3000;
app.listen(port, () => {
console.log(`listening to ${port}`);
})

Answer 1

Currently the /login route is creating a new user by calling new Auth() and logging in with it regardless of if the password does not match the one being stored.
You should be able to use the passport.authenticate method on your route to verify that the user is registered in your Mongo database. This method also automatically calls req.login.
app.post("/login", passport.authenticate("local",{
successRedirect: "/secret",
failureRedirect: "/login"
}));
Here is a fully example that uses passport-local-mongoose for reference: https://gist.github.com/yukeehan/23fbbe53f1ca94be440161c1562b489a