AUTHENTICATION WITH PASSPORT-JS AND EXPRESS: STRATEGY FOR USERNAME/PWORD LOGIN

When we want to log in a user via a username and password, we can use the passport-local library to define our strategy for verifying that their information is valid. 

This quiz reviews the first steps for creating a passport authentication strategy that our express server can use to log in users and manage their sessions.

Review the code for the questions that follow, then fill in the blanks (click on a blank, then click one of the answer options at the bottom of the page).

Click "next" to begin!

Consider this code, from a passport configuration file for an express server:

----------

import passport from "passport";
import { Strategy } from "passport-local";

passport.use(new Strategy(async (username, password, callback) => { ... }

------------
We import passport from the passport package, as well as the Strategy class from the passport-local package. 

On our passport object, we add middleware that will run when a user tries to login using a username and password; this middleware will tell passport what to do in order to validate a user's identity - for example, checking that this username exists in the database, verifying their password



Consider this code, inside the local strategy that we plug into Passport:

-------------------------

try {
        const existingUser = await UserModel.findOne({ username })
            .select(["email", "password"])
            .exec();
    
        if (!existingUser || !existingUser.password) {
            return callback(null, false);
        }
         .....
------------------

This code checks our database to see if there is a user document with the same username that was passed to this middleware. If the user does not exist, then this function will return the callback with the second argument set to false. 

The function will also return if there is no password on the user document; this would imply that the user has signed up using another method, such as social media login, and so they will be authenticated using another passport middleware (not passport-local).

Consider these next lines of code, from the same function: 


-------------------

const passwordMatch = await bcrypt.compare(password, existingUser.password);

        if (!passwordMatch) {
            return callback(null, false);
        }

---------------

Here, we use a bcrypt method to verify if the password passed to this function by the client matches the password that we retrieved for this username from our database. The password stored on the database is encrypted, so we need bcrypt to decrypt it and compare with the one passed by the client.

If the passwords do not match, this function will return the callback, with second argument set to false ; this indicates that there is not a valid user.

Here are the next lines of code, which will run only if there is a username and password matching with what the browser client has posted to our server:

-------------------

const user = existingUser.toObject();
delete user.password;

callback(null, user);

--------------------

The first method, toObject, will convert our mongo DB document to a regular javascript object.

The next line of code sanitizes our user object, so that the password is not passed on from this middleware. 

Finally, we execute the callback for this local strategy; however, rather than passing false for the second argument, we now pass the user object that we have retrieved; this tells passport that authentication was successful, and that it should continue with the next steps in the process.

Here's the final segment of code from our strategy for verifying login via username and password:

-----------------

    } catch (e) {
        callback(e);
    }

-----------------

If there is any error resulting from the execution of the lines of code preceding this catch block, the callback function will run, taking the error as an argument.

It's important to wrap any code that could result in an error in a try-catch block; otherwise, it can cause our server to crash.

Reviewing a setup for PassportJS local (username/password) strategy