Question

I am using express session to login user.

Middleware:

var requireLogin = function (req, res, next) {
    if (req.session.user) {
        next();
    } else {
        res.redirect('/'); 
    }
}

Route:

app.post('/login', requireLogin, routes.login);

exports.login = function (req, res) {
    var query = {username:req.body.username, password:req.body.password};

    User.find(query, function (err, data) {
        if (data) {
            req.session.user = data;
            console.log(data);
            res.redirect('/home');
        } else {
            console.log(err);
            res.redirect('/');
        }
    });
};

When I enter a wrong username and password, it still redirect to home, but the data is null.

Answer 1

find returns an array of match results and findOne returns a matching document.

I guess findOne is appropriate for this case.

app.post('/login', requireLogin, routes.login);

exports.login = function (req, res) {
    var query = {username:req.body.username, password:req.body.password}; 
    User.findOne(query, function (err, data) {
        if (data && !err) {
            req.session.user = data;
            console.log(data);
            res.redirect('/home');
        } else {
            console.log(err);
            res.redirect('/');
        }
    });
};