password.js身份验证和错误处理

Question

I have an API that authenticates a user from a mobile app. I'm running in to an issue where if a user logs in to the app with the wrong password or an invalid username then the node app crashes due to an authentication error being thrown, is there a way to have handle authentication errors in passport without crashing the api?

var mysql = require('mysql');
var bcrypt = require('bcrypt-nodejs');
var dbconfig = require('./database');
var connection = mysql.createConnection(dbconfig.connection);

connection.query('USE ' + dbconfig.database);
module.exports = function(passport) {


    passport.serializeUser(function(user, done) {
        done(null, user.id);
    });

    // used to deserialize the user
    passport.deserializeUser(function(id, done) {
        connection.query("SELECT * FROM saf_users WHERE id = ? ",[id], function(err, rows){
            done(err, rows[0]);
        });
    });

    passport.use(
        'local-login',
        new LocalStrategy({
            // by default, local strategy uses username and password, we will override with email
            usernameField : 'username',
            passwordField : 'password',
            passReqToCallback : true // allows us to pass back the entire request to the callback
        },
        function(req, username, password, done) { // callback with email and password from our form
            connection.query("SELECT * FROM saf_users WHERE username = ?",[username], function(err, rows){
let bcryptedPwd = rows[0].password;
  let newPwd = bcryptedPwd.replace(bcryptedPwd.charAt(2), "a");
                if (err)
                    return done(err);
                if (!rows.length) {
                    //return done(null, false, req.flash('loginMessage', 'No user found.')); // req.flash is the way to set flashdata using connect-flash
                return res.status(401).json({ message: 'Unauthorized user!' });

        }       


                if (!bcrypt.compareSync(password, newPwd))
                    //return done(null, false, req.flash('loginMessage', 'Oops! Wrong password.')); // create the loginMessage and save it to session as flashdata
                return res.status(401).json({ message: 'Unauthorized user!' });

                // all is well, return successful user
                return done(null, rows[0]);
            });
        })
    );
};

Answer 1

return res.status(401).json({ message: 'Unauthorized user!' });

you should rather do the following

return done({message: 'Unauthorized user!'});

basically the first argument in your done() callback takes the error. So you can return message to your user and not break your app. as @robertklep said, res isn't defined. But this is the best way to handle errors. You can check out this Example Here