I know that Passport.js exists, however, I wanted to code my own implementation using express-session module.

I'm using:

  • Express
  • Mongoose
  • express-session

So I basically have 2 routes for handling auth, POST /signup and POST /login.

This is what I've got, which I think is actually working but what I'm more concerned about is the session-handling.

var Account = require('../models/account');


    .post(function (request,response,next) {

        var email = request.body.email
        var password = request.body.password
        var login = new Account({"local.email":email,"local.password":password})

        Account.findOne({"local.email":email}, function (err,user) {

            if (err) {

            if (!user) {

            user.validPassword(password, function (err,matched) {

                if (err) {


                if (matched) {

                                var session = request.session
                                session.name = email                                            
                else {

    .delete(function (request,response) {

        request.session.destroy(function (err) {


    .post(function (request,response) {

        var doc = new Account({"local.email":request.body.email,"local.password":request.body.password})

        doc.save(function (err,saved) {

            if (err) response.status(500).end();

  • \$\begingroup\$ What is your question? \$\endgroup\$ – jfriend00 Oct 18 '14 at 22:21
  • \$\begingroup\$ My question is whether it's properly implemented. Shit I actually had a question but it was edited and so dropped off! \$\endgroup\$ – diegoaguilar Oct 18 '14 at 22:22
  • \$\begingroup\$ Sorry, I forgot to add it to the post body. It should be in there instead of in the title. \$\endgroup\$ – Jamal Oct 18 '14 at 22:30
  • \$\begingroup\$ It's OK Jamal, thanks for your edit though \$\endgroup\$ – diegoaguilar Oct 18 '14 at 22:57


This is pretty good, but doesn't have any password hashing (storing your passwords in plain text is bad).

You might want to instead consider using an authentication library like either passportjs or stormpath.

If you're really set on rolling your own auth stuff, you could use this project I wrote as an example (it's using the same tools you are): https://github.com/rdegges/svcc-auth

UPDATE: Since I was asked to show a Stormpath example, here ya go!

var express = require('express');
var stormpath = require('express-stormpath');

var app = express();
app.use(stormpath.init(app, {
  apiKeyId: 'xxx',  // get this from your stormpath account
  apiKeySecret: 'xxx',  // get this from your stormpath account
  secretKey: 'some_long_random_string',  // this is used to encrypt sessions
  application: 'xxx',  // create a stormpath app, then copy the href here


That's it! The above code will automatically generate a registration, login, and logout page at /register, /login, and /logout, respectively.

|improve this answer|||||
  • \$\begingroup\$ I am doing password hashing at the Mongoose model, before being saved ti DB, password gets hashed \$\endgroup\$ – diegoaguilar Oct 20 '14 at 23:33
  • \$\begingroup\$ Could you offer an example of stormpath auth? \$\endgroup\$ – diegoaguilar Oct 20 '14 at 23:33
  • \$\begingroup\$ Btw I just read your site and it would be even greater as you're a stormpath evangelist! \$\endgroup\$ – diegoaguilar Oct 21 '14 at 1:30
  • 1
    \$\begingroup\$ Just edited my answer to include a stormpath example =) \$\endgroup\$ – rdegges Oct 22 '14 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.