Unauthorized Login with wrong password

[basuabhirup]

As reported by some of our fellow students. The issue is something like this:

1. Go to localhost:3000/secrets
   --this should reroute you to the login page because you are not authenticated yet.

2. Login with the CORRECT email BUT USE AN INCORRECT PASSWORD.
   --You won't be redirected to the /secrets route.

3. Now manually go into localhost:3000/secrets
   --you should have access to the secrets page now despite having entered the wrong password.

I have the following suggestion to fix this issue by modifying the handler function of POST requests made on the /login route::

 // Handle 'POST' requests made on the '/login' route:
app.post('/login', passport.authenticate('local', {
  successRedirect: '/secrets',
  failureRedirect: '/login',
}));

As the official documentation page of passportJS says - "calling passport.authenticate() middleware invokes req.login() automatically", hence no need to call it separately before authenticating, leaving a glitch for unauthorized access.

[xwilliam89]

Glad I'm not the only one. Thank you for sharing @basuabhirup !
Yes, this is definitely a terrible bug. I hope Angela is able to fixes it in the next course update.

Let me share my solution as well. I just use their Custom Callback example:

app.post('/login', function(req, res, next) {
passport.authenticate('local', function(err, user, info) {
if (err) { return next(err); }
if (!user) { return res.redirect('/login'); }
req.logIn(user, function(err) {
if (err) { return next(err); }
return res.redirect('/secrets');
});
})(req, res, next);
});

[cleytonap]

I've came across the same issue.

Thanks a lot for sharing the solution, @basuabhirup!

[regan-mu]

I think the problem is login in a user before you authenticate them.
Here's my work around as well.

app.route("/login")
    .get((req, res) => {
        res.render("login");
    })
    .post((req, res, next) => {
        const email = req.body.username;
        const password = req.body.password;
        const newUser = new User(
            {
                username: email,
                password: password
            }
        );
        passport.authenticate("local", (err, user) => {
            if (err) {
                return next(err);
            }
            if (!user) {
                res.redirect("/login");
            }
            else {
                req.login(newUser, (err) => {
                    if (err) {
                        return next(err);
                    } else {
                        res.redirect("/secrets");
                    }
                });
            }
        })(req, res, next);
    });