title: Passport login and persisting session
body: <h1>Background</h1>
  
  <p>I have a MEAN application with CRUD capabilities fully tested with postman. I have been trying to persist login for quite some time now with no luck. I have read and tried the following </p>
  
  <ul>
  <li><a href="http://passportjs.org/">passport docs</a></li>
  <li><a href="http://toon.io/understanding-passportjs-authentication-flow/">toon io's blog about login</a></li>
  <li><a href="https://www.npmjs.com/package/express-session">Express session</a></li>
  <li><a href="https://scotch.io/tutorials/easy-node-authentication-setup-and-local">Scotch io, node auth made easy</a></li>
  <li>Plus a buch of other light reading materials (Lots of SO questions)</li>
  </ul>
  
  <p>But I have only been able to register and log a user in, not persist login with a session.</p>
  
  <h1>My App</h1>
  
  <p><a href="https://github.com/joeLloyd/MEANBoilerPlate">Here</a> is a link to the full github repo (if you are looking for the latest changes check develop branch)</p>
  
  <h1>My Understanding of Auth/Login</h1>
  
  <p>Here is my understanding of user login with code examples from my project and screenshot of postman results as well as console logs.</p>
  
  <h3>Passport setup</h3>
  
  <p>I have the following auth.js file, it configs passport</p>
  
  <pre><code>var passport = require('passport');
  var LocalStrategy = require('passport-local').Strategy;
  
  module.exports = function(app, user){
  
    app.use(passport.initialize());
    app.use(passport.session());
  
    // passport config
    passport.use(new LocalStrategy(user.authenticate()));
  
    passport.serializeUser(function(user, done) {
      console.log('serializing user: ');
      console.log(user);
      done(null, user._id);
    });
  
    passport.deserializeUser(function(id, done) {
      user.findById(id, function(err, user) {
        console.log('no im not serial');
        done(err, user);
      });
    });
  };
  </code></pre>
  
  <p>This gets called in the server file like</p>
  
  <pre><code>//code before
  var user    = require('./models/user.js');
  var auth    = require('./modules/auth.js')(app, user);
  // code after
  </code></pre>
  
  <h3>Routing for login</h3>
  
  <p>In my routes I have the login route as follows</p>
  
  <pre><code>router.post('/login', function(req, res, next) {
  
    passport.authenticate('local', function(err, user, info) {
  
      if (err) {
          return next(err);
      }
  
      if (!user) {
          return res.status(401).json({
              err: info
          });
      }
  
      req.logIn(user, function(err) {
  
          if (err) {
              return res.status(500).json({
                  err: 'Could not log in user'
              });
          }
  
          res.status(200).json({
              status: 'Login successful!'
          });
  
      });
    })(req, res, next);
  });
  </code></pre>
  
  <p>This route <strong>works</strong> as tested with postman. I enter the details 'joe' and 'pass' and get the following response.</p>
  
  <p><a href="https://i.stack.imgur.com/pHyFx.png"><img src="https://i.stack.imgur.com/pHyFx.png" alt="enter image description here"></a></p>
  
  <p>When this route is hit we can also see in the console that the user is serialized.</p>
  
  <p><a href="https://i.stack.imgur.com/edlc4.png"><img src="https://i.stack.imgur.com/edlc4.png" alt="enter image description here"></a> </p>
  
  <h1>So what next?</h1>
  
  <p>This is where I get lost. I have a few questions.</p>
  
  <ol>
  <li>Is the user now in a session on my server?</li>
  <li>Should I send the <code>req.session.passport.user</code> back to the client?</li>
  <li>Do I need the session ID on all future requests?</li>
  </ol>
  
  <h1>Testing the Session</h1>
  
  <p>I have a second route setup for testing the session it is as follows</p>
  
  <pre><code>router.get('/checkauth', passport.authenticate('local'), function(req, res){
  
      res.status(200).json({
          status: 'Login successful!'
      });
  
  });
  </code></pre>
  
  <p>The part <code>passport.authenticate('local')</code> (I thought) is there to test if the user session exists before giving access to the route but I never get a 200 response when I run this, even after a login.</p>
  
  <p>Does this route expect a <code>req.session.passport.user</code> passed in the head or as a data argument on a http request that requires auth?</p>
  
  <p>If I missed anything or am understanding something wrong please tell me, any input is appreciated. Thanks all.</p>