cannot access req or res objects from authenticate callback about passport HOT 4 CLOSED

Yes, that example has been confusing, since it didn't include the full scope. I've updated the documentation to clarify. Here's what it should look like:

app.get('/protected', function(req, res, next) {
  passport.authenticate('local', function(err, user, profile) {
    if (err) { return next(err) }
    if (!user) { return res.redirect('/signin') }
    res.redirect('/account');
  })(req, res, next);
});

When using the callback function, call authenticate() within your route handler, as opposed to using route middleware. That way the callback has access to req and res via the closure.

That should fix your issue. Let me know if you run into any others.

from passport.

@oroce For custom callbacks, that is the expected behavior.

When using custom callbacks, Passport defers handling to the application, and simply supplies the callback with the authenticated user and associated information. It won't modify the request, response, or session. If the app wants to establish a login session, it needs to call req.logIn(...) manually, as your example does.

As reported in #10, this isn't documented clearly. I'm in the process of updating the docs.

from passport.

As I can see, with callback req.logIn hasn't been called ever.

I'm using the following code: (it's coffeescript):

checkPassword: ( req, res, next ) ->
    passport.authenticate( "local", ( err, user, profile ) ->

        if err then return next( err )
        if !user 
            req.flash(
                "login-error",
                "User not exists."
            )
            return res.redirect( "/login" )
        req.logIn(user, {}, (err) ->
            if (err)
                return next(err)

            next();
        )
    )(req, res, next)

from passport.

@jaredhanson I see.

I posted my code to show the solution, if somebody wants a custom hack, like me:)

from passport.