Why is PassportJS in Node not removing session on logout

express, javascript, logout, node.js, passport.js

Solution

Brice’s answer is great, but I still noticed an important distinction to make; the Passport guide suggests using `.logout()` (also aliased as `.logOut()`) as such:

app.get('/logout', function(req, res){
  req.logout();
  res.redirect('/'); //Can fire before session is destroyed?
});

But as mentioned above, this is unreliable. I found it behaved as expected when implementing Brice’s suggestion like this:

app.get('/logout', function (req, res){
  req.session.destroy(function (err) {
    res.redirect('/'); //Inside a callback… bulletproof!
  });
});

Hope this helps!

Problem

I am having trouble getting my system to log out with PassportJS. It seems the logout route is being called, but its not removing the session. I want it to return 401, if the user is not logged in in specific route. I call authenticateUser to check if user is logged in. Thanks a lot! ``` /******* This in index.js *********/ // setup passport for username & passport authentication adminToolsSetup.setup(passport); // admin tool login/logout logic app.post("/adminTool/login", passport.authenticate('local', { successRedirect: '/adminTool/index.html', failureRedirect: '/', failureFlash: false }) ); app.get('/adminTool/logout', adminToolsSetup.authenticateUser, function(req, res){ console.log("logging out"); console.log(res.user); req.logout(); res.redirect('/'); }); // ******* This is in adminToolSetup ******** // Setting up user authentication to be using user name and passport as authentication method, // this function will fetch the user information from the user name, and compare the password for authentication exports.setup = function(passport) { setupLocalStrategy(passport); setupSerialization(passport); } function setupLocalStrategy(passport) { passport.use(new LocalStrategy( function(username, password, done) { console.log('validating user login'); dao.retrieveAdminbyName(username, function(err, user) { if (err) { return done(err); } if (!user) { return done(null, false, { message: 'Incorrect username.' }); } // has password then compare password var hashedPassword = crypto.createHash('md5').update(password).digest("hex"); if (user.adminPassword != hashedPassword) { console.log('incorrect password'); return done(null, false, { message: 'Incorrect password.' }); } console.log('user validated'); return done(null, user); }); } )); } function setupSerialization(passport) { // serialization passport.serializeUser(function(user, done) { console.log("serialize user"); done(null, user.adminId); }); // de-serialization passport.deserializeUser(function(id, done) { dao.retrieveUserById(id, function(err, user) { console.log("de-serialize user"); done(err, user); }); }); } // authenticating the user as needed exports.authenticateUser = function(req, res, next) { console.log(req.user); if (!req.user) { return res.send("401 unauthorized", 401); } next(); } ```

Original source