I know that Passport.js exists, however, I wanted to code my own implementation using express-session module.

I'm using:

  • Express
  • Mongoose
  • express-session

So I basically have 2 routes for handling auth, POST /signup and POST /login.

This is what I've got, which I think is actually working but what I'm more concerned about is the session-handling.

var Account = require('../models/account');


    .post(function (request,response,next) {

        var email = request.body.email
        var password = request.body.password
        var login = new Account({"local.email":email,"local.password":password})

        Account.findOne({"local.email":email}, function (err,user) {

            if (err) {

            if (!user) {

            user.validPassword(password, function (err,matched) {

                if (err) {


                if (matched) {

                                var session = request.session
                                session.name = email                                            
                else {

    .delete(function (request,response) {

        request.session.destroy(function (err) {


    .post(function (request,response) {

        var doc = new Account({"local.email":request.body.email,"local.password":request.body.password})

        doc.save(function (err,saved) {

            if (err) response.status(500).end();

  • \$\begingroup\$ What is your question? \$\endgroup\$
    – jfriend00
    Oct 18, 2014 at 22:21
  • \$\begingroup\$ My question is whether it's properly implemented. Shit I actually had a question but it was edited and so dropped off! \$\endgroup\$ Oct 18, 2014 at 22:22
  • \$\begingroup\$ Sorry, I forgot to add it to the post body. It should be in there instead of in the title. \$\endgroup\$
    – Jamal
    Oct 18, 2014 at 22:30
  • \$\begingroup\$ It's OK Jamal, thanks for your edit though \$\endgroup\$ Oct 18, 2014 at 22:57

1 Answer 1



This is pretty good, but doesn't have any password hashing (storing your passwords in plain text is bad).

You might want to instead consider using an authentication library like either passportjs or stormpath.

If you're really set on rolling your own auth stuff, you could use this project I wrote as an example (it's using the same tools you are): https://github.com/rdegges/svcc-auth

UPDATE: Since I was asked to show a Stormpath example, here ya go!

var express = require('express');
var stormpath = require('express-stormpath');

var app = express();
app.use(stormpath.init(app, {
  apiKeyId: 'xxx',  // get this from your stormpath account
  apiKeySecret: 'xxx',  // get this from your stormpath account
  secretKey: 'some_long_random_string',  // this is used to encrypt sessions
  application: 'xxx',  // create a stormpath app, then copy the href here


That's it! The above code will automatically generate a registration, login, and logout page at /register, /login, and /logout, respectively.

  • \$\begingroup\$ I am doing password hashing at the Mongoose model, before being saved ti DB, password gets hashed \$\endgroup\$ Oct 20, 2014 at 23:33
  • \$\begingroup\$ Could you offer an example of stormpath auth? \$\endgroup\$ Oct 20, 2014 at 23:33
  • \$\begingroup\$ Btw I just read your site and it would be even greater as you're a stormpath evangelist! \$\endgroup\$ Oct 21, 2014 at 1:30
  • 1
    \$\begingroup\$ Just edited my answer to include a stormpath example =) \$\endgroup\$
    – rdegges
    Oct 22, 2014 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.