Login system with NodeJS, MongoDB and Express

├── index.js
├── user.js
└── checkLoggedIn.js

npm install express mongoose express-session connect-mongo bcrypt

// index.js
import express from "express";
import mongoose from "mongoose";
import session from "express-session";
import MongoStore from "connect-mongo";
import { User } from "./user.js";
import checkLoggedIn from "./checkLoggedIn.js";
import bcrypt from 'bcrypt';

// Initialize the Express app
const app = express();
app.use(express.json());

// Connect to MongoDB
mongoose.connect("mongodb://localhost:27017/loginDemo", { useNewUrlParser: true, useUnifiedTopology: true });

// Initialize session middleware
app.use(
  session({
    secret: "mysecret",
    resave: false,
    saveUninitialized: false,
    store: MongoStore.create({ mongoUrl: "mongodb://localhost:27017/loginDemo" }),
  })
);

// Routes
app.post('/login', async (req, res) => {
  const { username, password } = req.body;

  const user = await User.findOne({ username });

  if (!user) {
    return res.send('Invalid username or password');
  }

  const isMatch = await bcrypt.compare(password, user.password);

  if (isMatch) {
    req.session.userId = user._id;
    return res.send('Logged in successfully');
  } else {
    return res.send('Invalid username or password');
  }
});

app.get("/logout", (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      res.status(500).send("Could not log out.");
    } else {
      res.send("Logout successful");
    }
  });
});

app.get("/protected", checkLoggedIn, (req, res) => {
  res.send("This is a protected route");
});

// Start the server
app.listen(3000, () => {
  console.log("Server running on http://localhost:3000/");
});

// user.js
import mongoose from "mongoose";
import bcrypt from 'bcrypt';

const UserSchema = new mongoose.Schema({
  username: String,
  password: String,
});

UserSchema.pre('save', function (next) {
  const user = this;
  if (this.isModified('password') || this.isNew) {
    bcrypt.hash(user.password, 10, (err, hash) => {
      if (err) {
        return next(err);
      }
      user.password = hash;
      next();
    });
  } else {
    return next();
  }
});

export const User = mongoose.model("User", UserSchema);

// checkLoggedIn.js
const checkLoggedIn = (req, res, next) => {
  if (req.session.userId) {
    next();
  } else {
    res.status(401).send("Not authorized. Please log in.");
  }
};

export default checkLoggedIn;