I am trying to store information on my req.session object upon login and at a later time access this to verify if a user is logged in for middleware
I am aware there are several similar questions but after implementing their solutions, I am either unable to get any data to save on my session or I am unable to access it.
The solutions that I have seen on similar questions have been
- Enabling cors on my express server
- Setting the withCredentials parameter on my axios request to true
- Calling session.save() after modifying my session
I should mention I am able to get this middleware function to work as desired with Postman which leads me to believe there is something wrong with how I am making my request.
I have the following signIn route
<code>router.post('/signin', async (req, res) => {
const { email, password } = req.body;
const user = await User.findOne({ email });
return res.status(400).send('User not found');
const isMatch = await bcrypt.compare(password, user.hashedPassword);
return res.status(400).send('Invalid credentials');
req.session.user = sessionUser;
console.log('Sign in successful: ', email)
res.status(200).send(req.session);
res.status(500).send('Error signing in');
<code>router.post('/signin', async (req, res) => {
const { email, password } = req.body;
try {
const user = await User.findOne({ email });
if (!user) {
return res.status(400).send('User not found');
}
const isMatch = await bcrypt.compare(password, user.hashedPassword);
if (!isMatch) {
return res.status(400).send('Invalid credentials');
}
const sessionUser = {
id: user._id,
email: user.email,
}
req.session.user = sessionUser;
console.log('Sign in successful: ', email)
req.session.save();
res.status(200).send(req.session);
} catch (err) {
res.status(500).send('Error signing in');
}
}
</code>
router.post('/signin', async (req, res) => {
const { email, password } = req.body;
try {
const user = await User.findOne({ email });
if (!user) {
return res.status(400).send('User not found');
}
const isMatch = await bcrypt.compare(password, user.hashedPassword);
if (!isMatch) {
return res.status(400).send('Invalid credentials');
}
const sessionUser = {
id: user._id,
email: user.email,
}
req.session.user = sessionUser;
console.log('Sign in successful: ', email)
req.session.save();
res.status(200).send(req.session);
} catch (err) {
res.status(500).send('Error signing in');
}
}
The following app.js file
<code>const createError = require('http-errors');
const express = require('express');
const path = require('path');
const cookieParser = require('cookie-parser');
const logger = require('morgan');
const mongoose = require('mongoose');
const authRoutes = require('./routes/auth');
const newsletterRoutes = require('./routes/newsletter');
const session = require('express-session');
const MongoStore = require('connect-mongo');
const cors = require('cors');
require('dotenv').config();
origin: "http://localhost:3000",
mongoose.connect('some_db_url');
const db = mongoose.connection;
db.on('error', console.error.bind(console, 'connection error:'));
db.once('open', function() {console.log('Connected to MongoDB');});
// Set up session middleware
secret: process.env.SESSION_SECRET,
resave: false, // don't save session if unmodified
saveUninitialized: false, // don't save session if there's nothing to save
cookie: { maxAge: 24 * 60 * 60 * 1000 }, // Session cookie expiration (1 day)
store: MongoStore.create({
client: db.getClient(), // necessary option
collectionName: 'sessions',
app.use(express.urlencoded({ extended: false })); // parse application/x-www-form-urlencoded
app.use(express.static(path.join(__dirname, 'public')));
app.use('/auth', authRoutes);
// catch 404 and forward to error handler
app.use(function(req, res, next) {
app.use(function(err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message;
res.locals.error = req.app.get('env') === 'development' ? err : {};
res.status(err.status || 500);
<code>const createError = require('http-errors');
const express = require('express');
const path = require('path');
const cookieParser = require('cookie-parser');
const logger = require('morgan');
const mongoose = require('mongoose');
const authRoutes = require('./routes/auth');
const newsletterRoutes = require('./routes/newsletter');
const session = require('express-session');
const MongoStore = require('connect-mongo');
const cors = require('cors');
require('dotenv').config();
const app = express();
app.use(cors(
{
origin: "http://localhost:3000",
credentials: true,
}
));
mongoose.connect('some_db_url');
const db = mongoose.connection;
db.on('error', console.error.bind(console, 'connection error:'));
db.once('open', function() {console.log('Connected to MongoDB');});
// Set up session middleware
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false, // don't save session if unmodified
saveUninitialized: false, // don't save session if there's nothing to save
cookie: { maxAge: 24 * 60 * 60 * 1000 }, // Session cookie expiration (1 day)
store: MongoStore.create({
client: db.getClient(), // necessary option
collectionName: 'sessions',
autoRemove: 'true',
stringify: 'false',
})
}));
app.use(logger('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: false })); // parse application/x-www-form-urlencoded
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));
app.use('/auth', authRoutes);
// catch 404 and forward to error handler
app.use(function(req, res, next) {
next(createError(404));
});
// error handler
app.use(function(err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message;
res.locals.error = req.app.get('env') === 'development' ? err : {};
// render the error page
res.status(err.status || 500);
res.render('error');
});
module.exports = app;
</code>
const createError = require('http-errors');
const express = require('express');
const path = require('path');
const cookieParser = require('cookie-parser');
const logger = require('morgan');
const mongoose = require('mongoose');
const authRoutes = require('./routes/auth');
const newsletterRoutes = require('./routes/newsletter');
const session = require('express-session');
const MongoStore = require('connect-mongo');
const cors = require('cors');
require('dotenv').config();
const app = express();
app.use(cors(
{
origin: "http://localhost:3000",
credentials: true,
}
));
mongoose.connect('some_db_url');
const db = mongoose.connection;
db.on('error', console.error.bind(console, 'connection error:'));
db.once('open', function() {console.log('Connected to MongoDB');});
// Set up session middleware
app.use(session({
secret: process.env.SESSION_SECRET,
resave: false, // don't save session if unmodified
saveUninitialized: false, // don't save session if there's nothing to save
cookie: { maxAge: 24 * 60 * 60 * 1000 }, // Session cookie expiration (1 day)
store: MongoStore.create({
client: db.getClient(), // necessary option
collectionName: 'sessions',
autoRemove: 'true',
stringify: 'false',
})
}));
app.use(logger('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: false })); // parse application/x-www-form-urlencoded
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));
app.use('/auth', authRoutes);
// catch 404 and forward to error handler
app.use(function(req, res, next) {
next(createError(404));
});
// error handler
app.use(function(err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message;
res.locals.error = req.app.get('env') === 'development' ? err : {};
// render the error page
res.status(err.status || 500);
res.render('error');
});
module.exports = app;
and on the frontend I have my handleSubmit function to sign in
<code>const handleSubmit = async (event) => {
const data = new FormData(event.currentTarget);
email: data.get('email'),
password: data.get('password'),
const response = await axios.post("http://localhost:8080/auth/signIn/", payload, {withCredentials: true});
if (response.status === 200) {
console.log('Login successful with ' + data);
if (error.response.status === 400) {
console.log('Invalid username or password');
console.error('Error while logging in', error);
<code>const handleSubmit = async (event) => {
event.preventDefault();
const data = new FormData(event.currentTarget);
const payload = {
email: data.get('email'),
password: data.get('password'),
}
try {
const response = await axios.post("http://localhost:8080/auth/signIn/", payload, {withCredentials: true});
if (response.status === 200) {
console.log('Login successful with ' + data);
}
} catch (error) {
if (error.response.status === 400) {
console.log('Invalid username or password');
} else {
console.error('Error while logging in', error);
}
}
};
</code>
const handleSubmit = async (event) => {
event.preventDefault();
const data = new FormData(event.currentTarget);
const payload = {
email: data.get('email'),
password: data.get('password'),
}
try {
const response = await axios.post("http://localhost:8080/auth/signIn/", payload, {withCredentials: true});
if (response.status === 200) {
console.log('Login successful with ' + data);
}
} catch (error) {
if (error.response.status === 400) {
console.log('Invalid username or password');
} else {
console.error('Error while logging in', error);
}
}
};
and lastly the following middleware function on my frontend
<code>export const isLoggedIn = () => {
const response = axios.get("http://localhost:8080/auth/check-auth/", {withCredentials: true});
if (response.status === 200) {
console.log('User authenticated, access granted')
if (error.response.status === 403) {
console.log('403: User not authenticated, access denied')
console.log('Unknown error while authenticating: ', error)
<code>export const isLoggedIn = () => {
try {
const response = axios.get("http://localhost:8080/auth/check-auth/", {withCredentials: true});
if (response.status === 200) {
console.log('User authenticated, access granted')
return true;
}
} catch (error) {
if (error.response.status === 403) {
console.log('403: User not authenticated, access denied')
return false;
} else {
console.log('Unknown error while authenticating: ', error)
return false;
}
}
}
</code>
export const isLoggedIn = () => {
try {
const response = axios.get("http://localhost:8080/auth/check-auth/", {withCredentials: true});
if (response.status === 200) {
console.log('User authenticated, access granted')
return true;
}
} catch (error) {
if (error.response.status === 403) {
console.log('403: User not authenticated, access denied')
return false;
} else {
console.log('Unknown error while authenticating: ', error)
return false;
}
}
}
In an attempt to access stored express-session data I enabled CORS on my express server and set withCredentials: true on axios requests from my frontend but my problem persists.