Passport Authentication immediately after New User Registration

Question

I'm trying to authenticate and login a user immediately after submitting a POST on the /register form. Ideally, I would like users to be able to register and then be redirected immediately to the dashboard without having to enter their credentials again.

My server is using Passport 0.1.17 with the local strategy configured to use email address and password for login. The current code is:

app.post('/register', function(req, res) {

  // attach POST to new User variable
  var registerUser = new User({ email: req.body.email, password: req.body.password, name: req.body.name });

  // save registerUser Mongo
  registerUser.save(function(err) {
    if(err) {
      console.log(err);
    } else {
      console.log('registerUser: ' + registerUser.email + " saved.");
    }
  });

  // here is where I am trying to authenticate and then redirect
  passport.authenticate('local', { failureRedirect: '/login', failureFlash: true }),
  res.redirect('/dashboard');
  });

How would I refactor this code to save the new user, then authenticate and finally redirect to the dashboard?

Thanks in advance!

Solution

Here's the solution I came up with after reading about req.login:

app.post('/register', function(req, res) {
  // attach POST to user schema
  var user = new User({ email: req.body.email, password: req.body.password, name: req.body.name });
  // save in Mongo
  user.save(function(err) {
    if(err) {
      console.log(err);
    } else {
      console.log('user: ' + user.email + " saved.");
      req.login(user, function(err) {
        if (err) {
          console.log(err);
        }
        return res.redirect('/dashboard');
      });
    }
  });
});

I would like to clean it up a bit and think that the err section could be more robust, but this is a functioning solution. Note that is someone else implements this, they should be aware that it is tailored to using the passport-local strategy with email instead of username.

Comments

[moka]

Use req.logIn method to authenticate straight after registration.

[surfearth]

Thanks for referencing req.logIn, which I was previously unaware of. Can you provide more specific code. I tried the following after the final comment in the question above, but it did not work: req.login(registerUser, function(err) { if (err) { return next(err); } return res.redirect('/dashboard'); });

[moka]

You need to provide details that are used to deserialize user, usually it is ID of a user that is stored in a session.

[Joe Dargie]

Query from a newbie: does that mean you’re storing the user’s password as plain text in your database? So if someone gets your database, they can read your user’s password?

[Matt]

@Paul D. White: I know this is old, but to answer your question for the benefit of future readers, it is common to handle encryption within the User model class itself, in a way that is transparent to the rest of the application (which has the benefit of making it unavoidable).