I'm using passport local strategy like this:
Config:
passport.use(new LocalStrategy({
usernameField: 'email'
},
function(email, password, done) {
UserPersistenceModel.findOne({ email: email }, function (err, user) {
if (err) return done(err);
if (!user) return done(null, false);
user.comparePassword(password, function(err, isMatch) {
if(err) return done(err);
if(!isMatch) return done(null, false);
return done(null, user);
});
});
}
));
My router definition looks like this:
var TokenRouter = function(app, passport, tokenSecret) {
//Create
app.post('/', function(req, res, next) {
console.log(req.body);
passport.authenticate('local', function(err, user, info) {
if (err) return next(err);
if (!user) {
console.log('Unsuccessful login!');
return res.status(401).json({ error: 'Login failed!' });
}
req.logIn(user, function(err) {
if (err) return next(err);
console.log('Successful login!');
//user has authenticated correctly thus we create a JWT token
var token = jwt.encode(user, tokenSecret);
res.json({ output : token });
});
})(req, res, next);
});
};
For some reasons I don't fully understand the passport "mechanism". The documentation doesn't look very detailled to me. One question is where the request object (this contains the body which contains the email and the password) is passed to my strategy. How does the strategy gets the email and the password (what's the "source object")?
The reason asking this is that I'd like to use the following inputModel instead of the request being passed to the strategy:
var TokenCreateInputModel = function(req) {
this.email = req.body.email;
this.password = req.body.password;
this.validate();
};
TokenCreateInputModel.prototype = Object.create(InputModel);
TokenCreateInputModel.prototype.validate = function() {
if(!this.email) throw new Error('Email is required!');
if(this.email.indexOf('#') == -1) throw new Error('Emailsyntax is wrong!');
if(!this.password) throw new Error('Password is required!');
};
module.exports = TokenCreateInputModel;
This inputmodel is converting the request and validating the data. I want to use this input model because it fits better to my architecture (I'm using such inputModels in all other cases ... just not with passport (because of the lack of my understanding), which seems to be inconsistent to me.
Related
I have been trying to use email and password to authenticate using passport-local. I had similar code when I was using username and it worked fine. With email, I made some changes however nothing is working. Right at the endpoint '/login' of type 'post' the condition !user condition in users.js (shown below as 2nd code snippet) is somehow executing. Its not even going inside passport.use. Following is the code:-
In user.js(model file),
var mongoose=require('mongoose');
var bcrypt=require('bcryptjs');
//user schema
var UserSchema=mongoose.Schema({
phone: {
type:String,
},
email:{
type: String,
index:{unique:true}
},
password:{
type: String
},
firstname:{
type: String
},
lastname:{
type: String
}
});
var User=module.exports = mongoose.model('User',UserSchema);
module.exports.getUserByUsername=function(email,callback){
var query={email:email};
User.findOne(query, callback);
}
module.exports.comparePassword=function(candidatePassword, hash, callback){
bcrypt.compare(candidatePassword, hash, function(err, isMatch) {
callback(null,isMatch);
});
}
}
In users.js(where i specify routes):
var express = require('express');
var router = express.Router();
var bodyParser=require('body-parser');
var User=require('../models/user');
var passport=require('passport');
var localStrategy=require('passport-local').Strategy;
router.post('/login', function(req, res, next) {
passport.authenticate('local', function(err, user, info) {
if (err) {
return next(err);
}
if (!user) { /*this is where the problem is this code executes everytime*/
return res.send('User not found');
}
req.logIn(user, function(err) {
if (err) { return next(err); }
return res.json(user);
});
})(req, res, next);
});
passport.serializeUser(function(user, done) {
done(null, user.id);
});
//for sessions
passport.deserializeUser(function(id, done) {
User.getUserById(id, function(err, user) {
done(err, user);
});
});
//this doesnt seem to work
passport.use(new localStrategy({usernameField:'email', passwordField:'password'},function(email,password,done){
User.getUserByUsername(email, function(err,user){
if(err) throw err;
if(!user){
return done(null,false,{message: 'User not found'});
}
User.comparePassword(password, user.password, function(err, isMatch){
if(err) return done(err);
if(isMatch){
return done(null, user);
}
else{
return done(null,false,{message: 'Password doesnt match our records'});
}
});
});
}));
Note that there is no front end on this. I am just using postman to test my apis.
This code works fine with emails. The issue was I also have another file called admin.js and admins.js which do the same task as user and users. However, admin makes use of username. I had the same passport.use code for admin however, users was trying to access that file instead of the current one. Once I removed the admin code it all worked.
After I login to my application, passport(local strategy) middleware matches the password to the one stored in database and routes me to the user page but it does not starts the session, due to which I am not able to authenticate post and get request for that user.
After playing around with code I found out that, passport.serializeUser and passport.deserializeUser are never called, I used console.log() to check the same.
I read the passport control flow from this link and found out that after password is matched and user is passed, the middleware calls req.login which further calls passport.serializeUser, I think in my case the req.login is never called because of which session is not maintained.
I have tried everything but am not able to figure out where I am going wrong.
This is my password Config :-
var LocalStrategy = require('passport-local').Strategy;
var User = require('../models/userModel');
module.exports = function(passport){
passport.serializeUser(function(user, done) {
console.log("serialize");
done(null, user._id);
});
passport.deserializeUser(function(id, done) {
console.log("deserialize");
User.getUserById(id, function(err, user) {
done(err, user);
});
});
passport.use(new LocalStrategy(function(username, password, done){
User.getUserByUsername(username, function(err, user){
if(err) throw err;
if(!user){
console.log("not user");
return done(null, false);
}
User.comparePassword(password, user.password, function(err, isMatch){
if(err) return done(err);
if(isMatch){
console.log("pass match");
return done(null, user);
} else {
console.log("invalid pass ");
return done(null, false);
}
});
});
}));
}
I always get the response "pass match" if I submit the correct user info in the login page.
This is login page where I have setup Authentication request
var LocalStrategy = require('passport-local').Strategy;
var passportAuth = require('../config/passport');
module.exports = function(app,bodyParser,passport){
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended:true}));
app.post('/api/loginAuth', (req,res,next)=> {
passport.authenticate('local', function(err, user, info ) {
if (err) {
console.log("inside error");
return next(err);
}
if (!user) {
console.log("No user");
res.status(401).send("not user");
} else {
console.log("verified user");
res.json(user);
}
})(req, res, next);
});
passportAuth(passport);
}
Passport and session setup in my app.js
var session = require('express-session');
var passport = require('passport');
// Handle Sessions
app.use(session({
secret:'secret',
saveUninitialized: true,
resave: true,
}));
// Passport
app.use(passport.initialize());
app.use(passport.session());
This is my angularjs Post request for authentication
$http({
method: 'POST',
url: '/api/loginAuth',
data: $scope.userinfo,
withCredentials: true
}).success (
function(response){
var message = '<strong>'+response.name+'</strong> Successfully logged in!! ';
sharedDataService.setMessage(message);
sharedDataService.setProperty(response.name);
$state.go('todo', {username: response.username});
});
Add this code to else part of app.post
req.logIn(user, function(err) {
if (err) { return res.send(err); }
res.json(user);
});
Like this
app.post('/api/loginAuth', (req,res,next)=> {
passport.authenticate('local', function(err, user, info ) {
if (err) {
console.log("inside error");
return next(err);
}
if (!user) {
console.log("No user");
res.status(401).send("not user");
} else {
req.logIn(user, function(err) {
if (err) { return res.send(err); }
res.json(user);
});
}
})(req, res, next);
});
I'm trying to confirm users email addresses by sending an activator code to their email address. when user clicked on activator URL (GET method), server will compare activator code + username and try to handle it.
I'm using GET method like this:
router.get('/activator/:username/:activator', function(req, res, next){
passport.authenticate('activator', function(err, user, info){
if (err) {console.log('Error info: ', info);}
else if (!user) {console.log('User not found: ' , info)}
else {console.log('User activated')}
res.redirect('/');
})(req, res, next)
});
And activator.js is:
var LocalStrategy = require('passport-local').Strategy;
var User = require('../models/user');
module.exports = function(passport){
passport.use('activator', new LocalStrategy({
usernameField: 'username',
passwordField: 'activator'
},
function(username, password, done) {
User.findOne({username: username , activator: password},
function(err, user){
if (err){
return done(null, false, 'User not found.');
}
user.activate = true;
user.save(function (err) {
if (err) return handleError(err);
return done(null, user, 'Persistence Registration successful');
});
});
})
);
};
But server response is: { message: 'Missing credentials'}
It seems passport js and GET method params has some conflicts.
Am i right? what should i do for that?
Problem solved!
As I said, problem was for GET method & passport connection.
passport function only read from req.query which is only on POST method but GET method is using req.params.
So I changed my application code to :
router.get('/activator/:username/:activator', function(req, res, next){
req.query = req.params; // GET to POST simulator!
passport.authenticate('activator', function(err, user, info){
if (err) {console.log('Error info: ', info);}
else if (!user) {console.log('User not found: ' , info)}
else {console.log('User activated')}
res.redirect('/');
})(req, res, next)
});
your Strategy fields are not valid, replace it with email and password and send same parameters from client side
module.exports = function(passport) {
passport.use('activator', new LocalStrategy({
usernameField: 'email',
passwordField: 'password',
},
function(username, password, done) {
User.findOne({
username: username,
activator: password
},
function(err, user) {
if (err) {
return done(null, false, 'User not found.');
}
user.activate = true;
user.save(function(err) {
if (err) return handleError(err);
return done(null, user, 'Persistence Registration successful');
});
});
}));
};
My model looks like this, but when I try use verifyPassword, it says TypeError: user.verifyPassword is not a function
var passport = require('passport');
var BasicStrategy = require('passport-http').BasicStrategy;
var User = require('../models/user');
passport.use(new BasicStrategy(
function(username, password, callback) {
User.findOne({ username: username }, function (err, user) {
if (err) { return callback(err); }
// No user found with that username
if (!user) { return callback(null, false); }
// Make sure the password is correct
// Error comind at this point
user.verifyPassword(password, function(err, isMatch) {
if (err) { return callback(err); }
// Password did not match
if (!isMatch) { return callback(null, false); }
// Success scenario
return callback(null, user);
});
});
}
));
Try to use User.verifyPassword function
But for more correct answer show your User model
You should have in your User schema something like:
// I am use bctypt, but you need your comparer function
userSchema.methods.verifyPassword = function(password, callback) {
callback(err, bcrypt.compareSync(password, this.password));
};
I know i am late but you can do something like this,
passport.use(
'local',
new LocalStrategy(function(username, password, done) {
User.findOne({ username: username }, function(err, user) {
if (err) {
return done(err);
}
if (!user) {
return done(null, false);
}
if (user.password != password) {
return done(null, false);
}
return done(null, user);
});
})
);
Reference : https://github.com/sikandar114/node-auth-pass-local/blob/master/config/passport.js
Since the data is sent by post method, express is not able to parse data because body-parser middleware has been omitted from express due to some issues. Hence you must add it manually.Import body-parser:
npm install body-parser
Add these lines to your code.
app.use(bodyParser.urlencoded({ extended: false }));
app.use(passport.initialize());
Also define these 2 functions.
passport.serializeUser(function(user, done) {
done(null, user);
});
passport.deserializeUser(function(user, done) {
done(null, user);
});
Try using passport.use(new LocalStrategy(User.authenticate()));
I'm new to node express and passport so I'm not sure what I'm missing. I'm trying to use a custom callback as all I want is a json response from my registration strategy. Currently I keep getting the following error "Missing credentials". I've been at it for a while now and I'm stuck.
Here is my controller:
app.post('/services/authentication/registration', function(req, res, next) {
console.log('before authentication')
passport.authenticate('local-registration', function(err, user, info) {
console.log('authentication callback');
if (err) { return res.send({'status':'err','message':err.message});}
if (!user) { return res.send({'status':'err','message':info.message});}
if (user!=false) { return res.send({'message':'registration successful'});}
})(req, res, next);
},
function(err, req, res, next) {
return res.send({'status':'err','message':err.message});
});
And my passport strategy:
passport.use('local-registration', new LocalStrategy({
// by default, local strategy uses username and password, we will override with email
usernameField : 'email',
passwordField : 'password',
passReqToCallback : true
},
function(req, email, password, done) {
console.log('credentials passed to passport' + email + '' + password)
// asynchronous
// User.findOne wont fire unless data is sent back
process.nextTick(function() {
// find a user whose email is the same as the forms email
// we are checking to see if the user trying to login already exists
User.findOne({ 'local.email' : email }, function(err, user) {
// if there are any errors, return the error
if (err)
return done(err);
// check to see if theres already a user with that email
if (user) {
return done(null, false, {message: 'User already exists'});
} else {
// if there is no user with that email
// create the user
var newUser = new User();
// set the user's local credentials
newUser.local.email = email;
newUser.local.password = newUser.generateHash(password);
// save the user
newUser.save(function(err) {
if (err)
throw err;
return done(null, newUser);
});
}
});
});
}));
I dont think you should send "req" as a parameter to the authentication function. take a look at this example from the passport docs:
passport.use(new LocalStrategy(
function(username, password, done) {
User.findOne({ username: username }, function (err, user) {
if (err) { return done(err); }
if (!user) {
return done(null, false, { message: 'Incorrect username.' });
}
if (!user.validPassword(password)) {
return done(null, false, { message: 'Incorrect password.' });
}
return done(null, user);
});
}
));