title: Passport local strategy and cURL
body: <p>I would like to test my node.js + express + passport.js test application (RESTful) with CURL. My code:</p>
  
  <pre><code>var express = require('express');
  var routes = require('./routes');
  var http = require('http');
  var path = require('path');
  var passport = require('passport');
  var LocalStrategy = require('passport-local').Strategy;
  
  // Define the strategy to be used by PassportJS
  passport.use(new LocalStrategy(
      function(username, password, done) {
          if (username === "admin" &amp;&amp; password === "admin") // stupid example
              return done(null, {name: "admin"});
  
          return done(null, false, { message: 'Incorrect username.' });
      }
  ));
  
  // Serialized and deserialized methods when got from session
  passport.serializeUser(function(user, done) {
      done(null, user);
  });
  
  passport.deserializeUser(function(user, done) {
      done(null, user);
  });
  
  // Define a middleware function to be used for every secured routes
  var auth = function(req, res, next){
      if (!req.isAuthenticated())
          res.send(401);
      else
          next();
  };
  
  var app = express();
  
  // all environments
  app.set('port', process.env.PORT || 3000);
  app.set('views', path.join(__dirname, 'views'));
  app.set('view engine', 'ejs');
  app.use(express.favicon());
  app.use(express.logger('dev'));
  app.use(express.json());
  app.use(express.urlencoded());
  app.use(express.methodOverride());
  app.use(passport.initialize());
  app.use(passport.session());
  app.use(app.router);
  app.use(express.static(path.join(__dirname, 'public')));
  
  // development only
  if ('development' == app.get('env')) {
      app.use(express.errorHandler());
  }
  
  app.get('/test', auth, function(req, res){
      res.send([{name: "user1"}, {name: "user2"}]);
  });
  
  app.post('/login', passport.authenticate('local'), function(req, res) {
      res.send(req.user);
  });
  </code></pre>
  
  <p>Calling /test with curl and</p>
  
  <pre><code>curl "http://localhost:3000/test"
  </code></pre>
  
  <p>returns "Unauthorized" (this is correct so far).</p>
  
  <p>Calling /login (POST) with curl and</p>
  
  <pre><code>curl --data "username=admin&amp;password=admin" http://localhost:3000/login
  </code></pre>
  
  <p>works. But at the next request my login was "forgotten".
  Is this because curl can't handle sessions? Is there any workaround?
  Is my procedure correct for a RESTful application?</p>