week5_day1

Passport | Sign Up, Login, Logout

Passport | Security & Roles

Main points: Passport | Sign Up, Login, Logout

Passport dispone de Local Strategy para gestionar el inicio de sesión mediante usuario/contraseña.

Setup:

Instalar y requerir dependencias:

const session = require("express-session")
const bcrypt = require("bcrypt")
const passport = require("passport")
const LocalStrategy = require("passport-local").Strategy
const flash = require("connect-flash")    // Error handling

Configurar middleware de express-session:

app.use(session({
  secret: "our-passport-local-strategy-app",
  resave: true,
  saveUninitialized: true
}))

Configurar serialización y deserialización de usuario:

passport.serializeUser((user, cb) => cb(null, user._id))
passport.deserializeUser((id, cb) => {
  User.findById(id, (err, user) => {
    if (err) { return cb(err) }
    cb(null, user)
  })
})

Configurar estrategia:

app.use(flash())    // Error handling
passport.use(new LocalStrategy({ passReqToCallback: true }, (req, username, password, next) => {
  User.findOne({ username })
    .then(theUser => {
      if (!theUser) return next(null, false, { message: "Nombre de usuario incorrecto" })
      if (!bcrypt.compareSync(password, theUser.password)) return next(null, false, { message: "Contraseña incorrecta" })
      return next(null, theUser);
    })
    .catch(err => next(err))
}))

Inicializar tanto passport como passport session:

app.use(passport.initialize())
app.use(passport.session())

Configurar dos endpoints para login (.get()y .post()) y uno para logout (.get()):

router.get("/login", (req, res) => res.render("auth/login", { "message": req.flash("error") }))
router.post("/login", passport.authenticate("local", {
  successRedirect: "/",
  failureRedirect: "/login",
  failureFlash: true,
  passReqToCallback: true
}))
router.get("/logout", (req, res) => {
  req.logout()
  res.redirect("/login")
})

robertompdev/week5_day1

week5_day1

Main points: Passport | Sign Up, Login, Logout