未定义Passport req.user。 deserializeUser返回一个有效的用户

Question

I'm using Express, MongoDB with MongoJS and Passport. My front-end is just vanilla JS on another domain. Currently, Express is saving a user from the front-end's form into Mongo and returning a cookie that the browser is properly saving. However, when I go initiate another route via a GET request from the front-end the result I get req.user === 'undefined' and req.isAuthenticated() === false . Passport seems to run passport.serializeUser and passport.deserializeUser correctly yet the user isn't getting set onto the request. I must be missing something?

Here's my code:

app.use(cookieParser('supernova'));
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json(options));
app.use(session({
    secret: 'supernova',
    resave: false,
    saveUninitialized: false,
    cookie: {
        maxAge: 60*60*1000,
        secure: false,
        httpOnly: false,
        domain: 'localhost'
    }
}));
app.use(passport.initialize());
app.use(passport.session());

Passport:

passport.use('local', new LocalStrategy(
    {passReqToCallback : true},
    (req, username, password, done) => {
        db.users.findOne({'username': username}, (error, user) => {
            if (error) {return done(error);}
            if (user) {
                log('User already exists');

                return done(user);
            } else {
                crypt.hashPassword(password, ((encryptedPassword) => {
                    var newUser = new User({username: username, password: encryptedPassword});
                    db.users.save(newUser, (err, data) => {
                        if (err) {
                            log(err);
                            return done(err)
                        }
                        log(data);

                        return done(null, data);
                    })
                }));
            }
        })
    }
));

passport.serializeUser(function(user, done) {
    log('serialize: ' + user._id)
    done(null, user._id);
});

passport.deserializeUser(function(id, done) {
    log('deserialize: ' + id)
    db.users.findOne({_id: mongojs.ObjectId(id)}, (err, user) => {
    log(user)
        if(err) {
            log(err);
            return done(err);
        }
        return done(err, user);
    });
});

function loggedIn(req, res, next) {
    log('logged in: ' + req.user);
    // log(req.session)
    if (req.isAuthenticated()) { return next(); }
    req.session.error = 'Please sign in!';
}

Headers:

app.use((req, res, next) => {
    res.setHeader('Access-Control-Allow-Origin', 'http://localhost:4200');
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
    res.setHeader('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
    res.setHeader('Access-Control-Allow-Credentials', true);
    next();
});

Routes:

app.post('/register', passport.authenticate('local', {session: true}), (req, res) => {
    req.session.save(() => {
        return res.redirect('/')
    })
});
app.use('/api', loggedIn, maps);

Initial Sign Up call made from front-end:

document.getElementById('signup').addEventListener('submit', function (e) {
    e.preventDefault();
    window.fetch(process.env.DB_API_URI + '/register', {
        method: 'POST',
        headers: {
            'Accept': 'application/json',
            'Content-Type': 'application/json',
        },
        credentials: 'include',
        body: JSON.stringify({
            username: document.getElementById('signUpUsername').value,
            password: document.getElementById('signUpPassword').value
        })
    })

2nd Front-End call where req.user is empty in Express:

return window.fetch(process.env.DB_API_URI + '/maps/' + mapId, {
            method: 'GET',
            headers: {
                'Content-Type': 'application/json'
            },
            credentials: 'include'
        })

Answer 1

The problem was the browser was sending two HTTP requests, an OPTIONS and a GET request. The OPTIONS request was not sending over the credentials and thus failing the authentication check. I bypassed this by updating my function to the following:

function loggedIn(req, res, next) {
    log('logged in: ' + req.isAuthenticated());
    if (req.isAuthenticated() || req.method === 'OPTIONS') {
        return next();
    }
    req.session.error = 'Please sign in!';
    res.status(400).send();
}