-
Notifications
You must be signed in to change notification settings - Fork 0
๐ User authentication
User authentication just like password hashing is a key feature within our web app. Without these features a login an registration is useless, without hashing passwords would be saved in plain text which is a HUGE no no and without authentication users can access areas of the web app without logging in (pages such as teacher and admin profiles).
Passport is authentication middleware for Node. There are over 500 ways to authenticate using Passport called strategies. Strategy we will be using is called passport-local
as we will using the users username and password to authenticate them.
We start by installing this node module by running $ npm install passport-local
in our terminal and requiring it in our code: const passport = require('passport');
. Next we write the middleware for Passport.js:
app.use(passport.initialize());
app.use(passport.session());
Now we can start writing the code for user authentication, here is an example of how your code can look like. We start by specifying which authentication strategy we are using. Next we check the username the user filled in in the input field to see if it matches any username within the database, if the username isn't found a message will display saying that that username has not been registered. When a user is found it will check if the input password matches the password within the database, when the passwords match the user logs in and a session is established it does this by serializing the user ID, if the user reloads the page or change pages the ID is used to find the user and maintain the session
const localStrategy = require('passport-local').Strategy;
passport.use(
new localStrategy({
usernameField: 'username'
}, (username, password, done) => {
// Match user
User.findOne({
username: username
}).then(async user => {
if (!user) {
console.log('username not found');
return done(null, false, {
message: 'That username is not registered'
});
}
const match = await argon2.verify(user.password, password);
if (match) {
return done(null, user);
} else {
console.log('password incorrect');
return done(null, false, {
message: 'Password is incorrect'
});
}
});
})
);
passport.serializeUser((user, done) => {
done(null, user.id);
});
passport.deserializeUser((id, done) => {
User.findById(id, (err, user) => {
done(err, user);
});
});
We'll need to protect the routes, in order to ensure visitors to our web app don't have access to pages only logged in users have access to.
Wiki for Blok Tech | Maijla Ikiz | Juliette Groot | Aidan Omwando | Tejo van der Burg | TECH2 |