Routing after Authentication

The last step we should take in our authentication system is to properly route users back to the index page after a successful login attempt. Since we will eventually be building a single-page application in Vue.js as our frontend for this application, we only need to worry about directing users back to the index page, which will load our frontend.

So, in our authSuccess method in routes/auth.js, we can update the response to redirect our users back to the index page:

// -=-=- other code omitted here -=-=-
const authSuccess = function (req, res, next) {
  res.redirect("/");
};

// -=-=- other code omitted here -=-=-

The res.redirect method will sent an HTTP 302 Found response back to the browser with a new location to navigate to. However, by that point, the authentication process will also send a cookie to the browser with the session ID, so the user will be logged in correctly:

Logout Route

Finally, we should also add a logout route. This route will end any sessions created through Passport.js by removing the session from the database and also telling the browser to delete the session cookie. It uses the special req.logout() method that is added to each request by Passport.js. We’ll add our logout route to the bottom of the routes/auth.js file:

// -=-=- other code omitted here -=-=-

// Import configurations
import "../configs/auth.js";
import logger from "../configs/logger.js";

// -=-=- other code omitted here -=-=-

/**
 * Logout of a Passport.js session
 * 
 * See https://www.initialapps.com/properly-logout-passportjs-express-session-for-single-page-app/
 *
 * @param {Object} req - Express request object
 * @param {Object} res - Express response object
 * @param {Function} next - Express next middleware function
 *
 * @swagger
 * /auth/logout:
 *   get:
 *     summary: logout current user
 *     description:  logout current user and end session
 *     tags: [auth]
 *     responses:
 *       200:
 *         description: success
 */
router.get('/logout', function (req, res, next) {
  res.clearCookie(process.env.SESSION_NAME || 'connect.sid');  // clear the session cookie
  req.logout(function(err) {       // logout of passport
    if (err) {
      logger.error(err);
    }
    req.session.destroy(function (err) {  // destroy the session
      if (err) {
        logger.error(err);
      }
      res.redirect('/');
    })
  });
})

// -=-=- other code omitted here -=-=-

Now, when we access this route with a valid session, we’ll see that the user is properly logged out.

We’ll also no longer be able to access the /auth/token route without logging in again.

However, this route WILL NOT invalidate any existing JWTs already issued to that user - they will still be valid until they expire. In our earlier example, we set the JWTs to have a 6 hour lifetime, so in theory a user could still access the application using a valid JWT up to 6 hours after logging out!