**Course Title:** Mastering Express.js: Building Scalable Web Applications and APIs **Section Title:** Authentication and Authorization **Topic:** Implementing user authentication using Passport.js. **Overview** In the previous topics, we introduced authentication and its types. Now, we'll implement user authentication in an Express.js application using Passport.js, a popular authentication middleware. Passport.js supports various authentication strategies, including local, OAuth, and OpenID Connect. We'll use local authentication to demonstrate its usage. **What is Passport.js?** Passport.js is an authentication middleware for Node.js that provides a set of frameworks for authentication using different strategies, such as username/password login, OAuth, and OpenID Connect. It's built on top of the Express.js framework and provides a lightweight and flexible way to handle authentication. **Installing Passport.js** First, you need to install Passport.js and the required strategy for local authentication. Run the following commands in your terminal: ```bash npm install passport npm install passport-local ``` **Configuring Passport.js** Next, configure Passport.js to use the local strategy for authentication. Create a new file called `passport.js` and add the following code: ```javascript // Import passport.js const passport = require('passport'); const LocalStrategy = require('passport-local').Strategy; const mongoose = require('mongoose'); // Import the User model const User = require('./models/User'); // Define a callback function to validate user credentials passport.use(new LocalStrategy({ usernameField: 'email', passwordField: 'password' }, function(email, password, done) { User.findOne({ email: email }, (err, user) => { if (err) { return done(err); } if (!user || !user.validPassword(password)) { return done(null, false, { message: 'Invalid email or password' }); } return done(null, user); }); } )); // Serialize user session passport.serializeUser((user, done) => { done(null, user._id); }); // Deserialize user session passport.deserializeUser((id, done) => { User.findById(id, (err, user) => { done(err, user); }); }); ``` This code defines a callback function to validate user credentials and serialize and deserialize user sessions. **Configuring Express.js** Next, configure Express.js to use Passport.js for authentication. Open your main application file (usually `app.js`) and add the following code: ```javascript // Import passport.js configuration const passportConfig = require('./passport'); // Initialize Passport.js passportConfig(passport); // Use Passport.js for authentication app.use(passport.initialize()); app.use(passport.session()); ``` **Implementing Local Authentication Strategy** Create a route for handling local authentication requests. Create a new file called `auth.js` and add the following code: ```javascript // Import passport.js const passport = require('passport'); // Define login route handler export const login = (req, res, next) => { passport.authenticate('local', (err, user, info) => { if (err) { return next(err); } if (!user) { return res.status(401).json({ message: 'Invalid email or password' }); } req.logIn(user, (err) => { if (err) { return next(err); } res.json({ message: 'Login successful' }); }); })(req, res, next); }; // Define logout route handler export const logout = (req, res) => { req.logout(); res.json({ message: 'You are logged out' }); }; ``` This code defines route handlers for handling local authentication requests (login and logout). **Using Local Authentication** To test local authentication, create a new route in your main application file (usually `app.js`) for handling login and logout requests. Add the following code: ```javascript const authController = require('./authController'); // Define login route app.post('/login', authController.login); // Define logout route app.get('/logout', authController.logout); ``` **Conclusion** In this topic, you learned how to implement user authentication using Passport.js in an Express.js application. You saw how to install and configure Passport.js, implement local authentication strategy, and define route handlers for handling authentication requests. You can now test local authentication in your application using Postman or a similar tool. **Additional Resources:** * [Passport.js Documentation][1] * [Passport.js GitHub Repository][2] Feel free to ask questions or share your thoughts in the comments section below. The next topic will cover 'Creating and managing user sessions'. Stay tuned! [1]: http://www.passportjs.org/docs/ [2]: https://github.com/jaredhanson/passport