This walkthrough will show you how to deploy a containerized Node.js app to Amazon Web Services and also assign a secure custom domain. We will be applying the following technologies and tools:
- Application: Node.js Express
- Container: Docker and Github
- Cloud Compute: AWS EC2 Ubuntu
- Domain: AWS ElasticIP, AWS Route53 and Namecheap Domains
- HTTPS: Nginx and Let's Encrypt

Click here for a [link to the github repo](https://github.com/howardmann/express_ec2)

## Summary Steps
1. [Create Node App with Dockerfile and deploy to Github](#1)
2. [Create EC2 Instance](#2)
3. [SSH into EC2 Instance](#3)
4. [Setup and Install EC2 Dependencies](#4)
5. [Create Route 53](#5)
6. [Purchase Namecheap Domain](#6)
7. [Setup Nginx and HTTPS](#7)

## <a name="1"></a>1. Create Node App with Dockerfile and deploy to Github
Create a simple Node Express app with the following folder structure
```bash
src
  L index.js
Dockerfile
package.json
```
Create a simple hello world web app.
```javascript
// src/index.js
let express = require('express')
const PORT = process.env.PORT || 3000

let app = express()

app.get('/', (req, res) => {
  res.send('hi')
})

// Custom 404 route not found handler
app.use((req, res) => {
  res.status(404).send('404 not found')
})

app.listen(PORT, () => {
  console.log(`Listening on PORT ${PORT}`);
})
```
Create Dockerfile which will install specific version of node, install dependencies, expose relevant port and run start command.
```Dockerfile
# // Dockerfile

# Select node version and set working directory
FROM node:8-alpine
RUN mkdir -p /usr/src/app
WORKDIR /usr/src/app

# Install app dependencies
COPY package.json /usr/src/app
RUN npm install

# Bundle app source
COPY . /usr/src/app

# Expose publc port and run npm command
EXPOSE 3000
CMD ["npm", "start"]
```
Test locally by building the Docker image (check Docker desktop app is running).
```
docker build . -t <YOUR_APP_NAME>
```
Test locally by running the app. Expose port 3000 (we will later use Nginx reverse proxy to send HTTPS port 80 requests to localhost:3000)
```
docker run -p 3000:3000 <YOUR_APP_NAME>
```
Commit and deploy to a Github repo where we will later clone from our EC2 Instance.
```bash
git add .
git commit -m "initial commit"
git remote add origin "<YOUR_GITHUB_REPO_URL>"
git push origin master
```

## <a name="2"></a>2. Create EC2 Instance
Create a new AWS EC2 Instance and set a fixed public IP.
- Login to AWS Management Console
- Select EC2 and select Launch Instance
- Choose latest Ubuntu Server
- Setup security groups including HTTP port 80 and HTTPS
![security](//images.ctfassets.net/vwq10xzbe6iz/5dRssqwYvnxOMyFVIOLnX/ba405930771458831715c7e1bfacfceb/security.png)
- Create instance and create name of private key and download (you will need this to ssh login to your cloud instance)
- Create Elastic IP and associate to your instance. This will keep a fixed public IP address for your instance
![elasticIP](//images.ctfassets.net/vwq10xzbe6iz/5AVVA2E0UzUqhGcQfDmWBa/f2c18d8996125fe2534695aac49ed83d/elasticIP.png)

## <a name="3"></a>3. SSH into EC2 Instance
Login to our newly created EC2 Instance via SSH.
- Find and select your running EC2 instance and click Connect then follow the instructions
![ssh](//images.ctfassets.net/vwq10xzbe6iz/226QhCsKBmdu81LQdB2mqF/ad12eddc2891009eb7e04b1732b9b660/ssh.png)
- Download your private key and run the following command to allow read ownership `chmod 400 <YOUR_PRIVATE_KEY_NAME>.pem`
- If you forget your private key you will not be able to easily SSH back in
- To asssist workflow create a folder named SSH in your local directory and include in .gitignore. You can keep your private key here and a textline of the SSH script. Then come back to this folder whenever you need to SSH in.

## <a name="4"></a>4. Setup and Install EC2 Dependencies
Clone github repo, install Docker, build image and run new image.
- SSH into instance (follow instructions by clicking on "Connect" in the instance). See AWS console to find exact ssh command, ensure you are in the root directory with your private key
```
ssh -i "<YOUR_PRIVATE_KEY_LOCATION_FILE.pem> <YOUR_USER>@<YOUR_AWS_PUBLIC_DNS>
```
- Once login successful, clone your github repo
```
git clone <YOUR_GITHUB_REPO_URL>
```
- Install Docker
```
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
```
- Run Docker without sudo in ubuntu
```
cat /etc/passwd | grep ubuntu
sudo usermod -aG docker ubuntu
```
- Exit EC2 Instance and SSH back in and check you can run docker without sudo
```
docker ps
```
- Rebuild the Docker image (similar to what we did when testing locally)
```
docker build . -t <YOUR_APP_NAME>
```
- Run the Docker image in detatched mode `-d` which will let it continue to run in the background. Set restart as always so it will run when the EC2 instance is restarted.
```
docker run --restart always -d -p 3000:3000 -t <YOUR_APP_NAME>
```
- If you exposed port 3000 in the EC2 instance you should now be able to see the application if you visit the public DNS
- To get the container id
```
docker ps
```
- To see container logs
```
docker logs <YOUR_CONTAINER_ID>
```
- To stop the container
```
docker stop <YOUR_CONTAINER_ID>
```

## <a name="5"></a>5. Create Route 53
Setup AWS Route53 for DNS forwarding from our custom domain to relevant EC2 Instances.
- Search for Route53 Service in AWS Management Console
- Get started and create a hosted zone
- Create the hosted zone and enter the domain name you wil purchase from namecheap
- Once clicked you will see the `NS` records. Copy a record of these
![ns](//images.ctfassets.net/vwq10xzbe6iz/6LJAjqKCGYpuSuZlf3WjbB/fffb15c71174129a88101511f1835974/ns.png)

## <a name="6"></a>6. Purchase Namecheap Domain
Purchase custom domain and point to AWS Route 53.
- Purchase domain from namecheap and then set the Custom DNS to each of the `NS` records from Route53
![namecheap-dns](//images.ctfassets.net/vwq10xzbe6iz/1JwQpYnZCGr0qHnfNqq18G/4e156a31c53eddf89e57491a67c74c89/namecheap-dns.png)
- Connect your Route 53 to Namecheap. Copy the public "IPv4 Public IP" of your EC2 Instance. Hit create record set button and create 2 records below. One set name as empty while latter prefi with *. Copy into value the IPv4 Public IP address into reach
![recordset](//images.ctfassets.net/vwq10xzbe6iz/5HDmGeJ5OnLA7DRSZfF0Qe/adf6dac31f91435eecebf221a509d3fa/recordset.png)

## <a name="7"></a>7. Setup Nginx and HTTPS
Nginx reverse proxy port 80 to our Docker instance and setup secure HTTPS.
- SSH into EC2 Instance and setup nginx webserver
```
sudo apt-get install nginx
```
- Install certbot and build certificate
```
sudo apt-get install software-properties-common
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get install python-certbot-nginx
```
- Make the certificate with the given domain names you have purchased. It may prompt for email
```
sudo certbot --nginx -d example.com -d www.example.com
```
- Remove default config file
```
sudo rm /etc/nginx/sites-enabled/default
```
- Create new file 
```
cd /etc/nginx/sites-available/
sudo touch node
sudo vim /etc/nginx/sites-available/node
```
- Paste the following code in the file and replace example.com with your purchased domain and 3000 with your Node port
```
server {
  listen 80;
  listen [::]:80;
  server_name example.com www.example.com;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl http2 default_server;
  listen [::]:443 ssl http2 default_server;
  server_name example.com www.example.com;

  location / {
    proxy_pass http://localhost:3000;
  }

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_session_cache shared:SSL:5m;
  ssl_session_timeout 1h;
  add_header Strict-Transport-Security “max-age=15768000” always;
}
```
- Symlink config file to sites-enabled 
```
sudo ln -s /etc/nginx/sites-available/node /etc/nginx/sites-enabled/node
```
- Restart nginx and apply
```
sudo service nginx restart
```
- If nginx error due to port 80 already in use. Find, kill and restart nginx
```
sudo fuser -k 80/tcp
sudo service nginx start
```

That's it. 

You should now be able to visit your custom domain and be pointed to your Dockerized Node App on HTTPS.


Walkthrough to deploy an Express.js app to AWS EC2 with HTTPS and custom domain using Express, Docker, AWS EC2, AWS Route53, Namecheap, Nnginx and Let's Encrypt. 

How to Deploy a Node App to AWS EC2

How to validate requests and handle errors in Express.js using [Joi](https://github.com/hapijs/joi) validation library. [Click here for a link to the repo](https://github.com/howardmann/validation).

1. [Gentle introduction to Joi validation](#1-joi)
2. [General route error handling in Express.js](#2-route)
3. [Three examples of handling request validations](#3-validation)
4. [Flash form validation errors](#4-flash)

## <a name="1-joi"></a>  1. Gentle introduction to Joi validation
Joi is an expressive validator library for JavaScript objects. It helps ensure inputs are checked before progressing (e.g. to a DB).

You first create a schema and then validate the payload against the schema. If invalid it will throw the relevant error message.
```javascript
let Joi = require('joi')

// Create schema
let createProductSchema = Joi.object().keys({
  description: Joi.string().required(),
  price: Joi.number().min(0.01).required()
})

let payload = {
  description: 'red book',
  price: 0.0001
}

Joi.validate(payload, createProductSchema)
  .then(validated => {
    console.log(validated);
  })
  .catch(err => {
    console.log(err);
    // [ { message: '"price" must be a number',
    // path: [ 'price' ],
    // type: 'number.base',
    // context: { value: null, key: 'price', label: 'price' } } ]
  })
```

We can DRY our code and refactor the schemas and validators into separate files
```javascript
// validation/schemas/productSchema.js
let Joi = require('joi')

// We can reuse schemas
let priceSchema = Joi.number().min(0.01)

// Schema for creating a product, all fields are required
let createProductSchema = Joi.object().keys({
  description: Joi.string().required(),
  price: priceSchema.required()
})

// Schema for editing a product, all fields are optional and we can have a custom error message
let editProductSchema = Joi.object().keys({
  description: Joi.string(),
  price: priceSchema.error(() => 'when editing price must be number greater than 0.01')
})

module.exports = { 
  createProductSchema, 
  editProductSchema
}
```

```javascript
//validation/createValidator.js
let Joi = require('joi')

// DRY our code with higher order function
const createValidator = (schema) => 
  (payload) => {
    return Joi.validate(payload, schema, {
      // shows all error messages instead of first error message
      abortEarly: false
    })
  }

module.exports = createValidator
```

## <a name="2-route"></a> 2. General route error handling in Express.js
We need to create two error handlers in our express application to handle all server errors and 404 route errors.

This way if we throw an error in any of our other routes the error handler will catch and display the relevant error message.

```javascript
let express = require('express')
let bodyParser = require('body-parser') // handle req.body
let app = express()
app.use(bodyParser.json())

// Require routes
app.use(require('./routes'))

// Custom server error handler
app.use((err, req, res, next) => {
  if (err) {
    console.error(err.message)
    if (!err.statusCode) {err.statusCode = 500} // Set 500 server code error if statuscode not set
    return res.status(err.statusCode).send({
      statusCode: err.statusCode,
      message: err.message
    })
  }

  next()
})

// Custom 404 route not found handler
app.use((req, res) => {
  res.status(404).send('404 not found')
})

const PORT = 3000
app.listen(PORT, () => {
  console.log(`Listening on PORT ${PORT}`);
})
```

## <a name="3-validation"></a> 3. Three examples of handling request validations
We can validate incoming Express payload requests using Joi in 3 ways:
1. We handle the payload within the route and catch error if its invalid
2. Create a custom middleware ([see next section](###Generic-Middleware)) to handle the validation and throw error if invalid
3. Use the [celebrate](https://github.com/arb/celebrate) library which does same as option 2 but with more features

```javascript
let express = require('express');
let router = express.Router();


// Validation
let createValidator = require('../validation/createValidator')
let { createProductSchema } = require('../validation/schemas/productSchema')
let validate = require('../validation/validateMiddleware')
let {celebrate} = require('celebrate')


// 1. Validation using Joi within route
let validateProductCreate = createValidator(createProductSchema)

router.post('/products', (req, res, next) => {
  validateProductCreate(req.body)
    .then(validatedProduct => {
      res.send({status: 'success', validatedProduct})
    })
    .catch(next)
})

// 2. Validation using Joi custom middleware
router.post('/products2', validate(createProductSchema), (req, res, next) => {
  let payload = req.body
  res.send({status: 'success', payload})
})

// 3. Validation using celebrate middleware library
router.post('/products3', celebrate({body: createProductSchema}), (req, res, next) => {
  let payload = req.body
  res.send({status: 'success', payload})
})

module.exports = router;
```
### Generic Middleware
For option 2 we can create a generic middleware to handle validations.
```javascript
// validation/validateMiddleware
let createValidator = require('./createValidator')

let validateMiddleware = (schema) =>
  (req, res, next) => {
    let payload = req.body
    let validate = createValidator(schema)

    // proceed next if validated otherwise catch error and pass onto express error handler
    validate(payload)
      .then(validated => {
        req.body = validated
        next()
      })
      .catch(next)
  }

module.exports = validateMiddleware
```

For option 3 we must also add the celebrate error handler in our server file above our custom error handlers. This gives us more verbose error handling messaging.
```javascript
//server.js
let {errors} = require('celebrate') // handle celebrate joi errors

let app = express()

// Require routes
app.use(require('./routes'))

// Celebrate library error handler
app.use(errors())

// Custom server error handler
app.use((err, req, res, next) => {
})

// Custom 404 route not found handler
app.use((req, res) => {
})

const PORT = 3000
app.listen(PORT, () => {
})
```

## <a name="4-flash"></a> 4. Flash form validation errors
The methods above handle API validation errors. However, we may also want to display form validation errors in the browser as a flash message:

![form validation](https://raw.githubusercontent.com/howardmann/validation/master/img/validation.png)

In this example we will have a signup form that requires three fields (email, name and password). It will validate and flash relevant validation errors.

We will achieve this in stages:
1. Setup express to  display flash messages
2. Create user schema and HTML form
3. Setup routes to handle validations
4. DRY using middleware

### 1. Display flash messages
To display flash messages we need two libraries:
- `connect-flash` for flashing messages; and
- `express-session` for storing sessions server-side in memory

We write a custom middleware to store the session message as a global variable in views in order to access it in any view template.

```javascript
// server.js
let session = require('express-session')
let flash = require('connect-flash')

// session and flash views
app.use(session({
  secret: 'ilikecats',
  cookie: {},
  resave: false,
  saveUninitialized: true
}));
app.use(flash())

// store three flash variables as global variables in views
app.use((req, res, next) => {
  res.locals.messageSuccess = req.flash('messageSuccess')
  res.locals.messageFailure = req.flash('messageFailure')
  res.locals.validationFailure = req.flash('validationFailure')
  next();
})
```

Then in our views layout we insert placeholders to be able to render these flash messages if they exist. For the `validationFailure` it will be passed an array of messages so we want to loop through and display as a bullet points.
```hbs


<div style="background-color: red">
  {{messageFailure}}
</div>

<div style="background-color: green">
  {{messageSuccess}}
</div>

<div style="background-color: red">
  {{#if validationFailure}}
  <p>Validation Errors</p>
  {{/if}}
  <ul>
    {{#each validationFailure}}
    <li>
      {{this}}
    </li>
    {{/each}}
  </ul>
</div>

{{{body}}}
```
### 2. User schema and form
As with our product schema above we will create a user schema to handle validation using `Joi`.

```javascript
//validation/schemas/userSchema
let Joi = require('joi')

module.exports = Joi.object().keys({
  email: Joi.string().email(),
  name: Joi.string(),
  password: Joi.string().min(7).alphanum()
})
```

Now create a simple HTML form in our view template
```handlebars

<form action="/signup" method="POST">
  <input type="email" placeholder="enter email" name="email">
  <input type="text" placeholder="enter name" name="name">
  <input type="password" placeholder="enter password" name="password">
  <input type="submit">
</form>
```

### 3. Setup signup routes
Use the validation helpers we used before along with the schema we created above. Create two routes: 1) for displaying the signup form and 2) for handling the form submission.

Validate the payload using Joi and if validation errors flash validation errors and redirect bac to form.
```javascript
//routes
let express = require('express');
let router = express.Router();
let createValidator = require('../validation/createValidator')
let {createUserSchema} = require('../validation/schemas/userSchema')
let validateUser = createValidator(createUserSchema)

// display signup form
router.get('/signup', (req, res, next)) => {
  res.render('signup')
}

// handle submit signup form 
router.post('/signup', (req, res, next)) => {
  let payload = req.body
  
  // Joi validation
  validateUser(payload)
    .then(data => {
      // If success; flash success message and redirect to form
      console.log(data)
      req.flash('messageSuccess', 'Success valid input')
      res.redirect('/signup')
    })
    .catch(err => {
      // If validation error flash array of messages and redirect
      let errorMessages = err.details.map(el => el.message)
      console.log(errorMessages)
      req.flash('validationFailure', errorMessages)
      res.redirect('/signup')
    })
}

module.exports = router
```

### 4. DRY with middleware
If we have many forms that require validating (e.g. for both edit and create) we can refactor our validation into a custom middleware.

Create a validateForm middleware function that takes a Joi schema as an argument and redirects back with validationFailure flash message if error.

```javascript
//validation/middlewares/validateForm 
let createValidator = require('../createValidator.js')

module.exports = (schema) =>
  (req, res, next) => {
    let payload = req.body
    let validate = createValidator(schema)

    validate(payload)
      .then(validated => {
        req.body = validated
        next()
      })
      .catch(err => {
        let errorMessages = err.details.map(el => el.message)
        console.log(errorMessages)
        req.flash('validationFailure', errorMessages)
        res.redirect('back')
      })
  }
```

We can now use it as reusable middleware for any route.
```javascript
//routes/index.js
let validateForm = require('../validation/middlewares/validateForm')

// middleware handles redirect back with validationFailure flash message
// route then only has to deal with success outcome
router.post('/signup', validateForm(createUserSchema), (req, res, next) => {
  let payload = req.body
  // handle payload etc. in db
  console.log(payload);
  req.flash('messageSuccess', 'woohoo')
  res.redirect('/signup')
})

```

Learn how to validate requests and handle errors using Node Express.js with Joi validation library. Validate API requests and display HTML form errors using custom middleware.

Express Validation and Error Handling

Tutorial and demo app using passport.js for basic principles of authentication and authorization.

[Click here for a live demo of the app.](https://authdemo.now.sh)
You can use the example admin credentials (email: howie@email.com password: chicken)

[Click here for the github repo](https://github.com/howardmann/authentication)

### Overview of demo app:
As a public user, I can:
- view the homepage
- visit the signup page and create a new account
- visit the login page

As a logged in user, I can:
- view my private profile page
- view special pages only visible to logged in users
- logout

As a logged in user with admin privileges, I can do all of the above plus:
- view all users
- view admin pages

Here is an overview of pages and permissions.
```shell
PAGES
page              permission
/                 public homepage
/special          restricted to signed up and logged in users
/users/profile    restricted to profile of logged in user
/admin            restricted to loggedin admin users
/users            restricted to loggedin admin users

AUTH
method    path             description
GET       /login           render login view form page
POST      /login           authenticate email and password and redirects to profile page if success and login page again if fail
GET       /signup          render signup view form page
POST      /signup          create user and redirect to profile page if success and signup page with flash message if fail
GET       /logout          clears session and redirects to login page


```

Dependency descriptions
```javascript
  "dependencies": {
    "bcrypt": "^3.0.6", // for hashing passwords 
    "body-parser": "^1.19.0", // to capture form post data in req.body
    "connect-flash": "^0.1.1", // flash messages 
    "dotenv": "^8.0.0", // environment variables
    "express": "^4.17.1", // http web server
    "express-handlebars": "^3.1.0", // template engine
    "express-session": "^1.16.1", // track sessions
    "mongoose": "^5.5.12", // mongodb ORM
    "passport": "^0.4.0", // authentication
    "passport-local": "^1.0.0" // passport strategy for local DB auth (e.g. username and password)
  }

```

This is a summary of the relevant directories
```shell
auth // where all the authorization and authentication logic lives
  L middleware
    L flashMessageInViews.js  // enables all views to access {{messageSuccess}} and {{messageFailure}}
    L userInViews.js // enables all views to check if user session exists, e.g. enables us to flash login or logout link
  L authorization.js // middleware to gate routes (e.g. loginRequired, adminRequired, signupRequired)
  L index.js // entry point
  L logInOut.js // login and out pages and passport authentication logic
  L register.js // signup page and create user passport logic
  L serializer.js // serializes session user_id via passport
routes // where routes live
  L index.js // calls auth methods
  L pages.js // other pages
  L users.js // users pages
views
  L auth // templates for login and signup page
    L login.hbs
    L signup.hbs
  L pages
  L users
  L layouts
repositories // applying clean programming principles (separation of concerns) to make it easier to switch out DBs
  L userRepository.js // model wrapper for user CRUD operations
  L memory // user in memory (start off for dev purposes)
  L mongodb // user in mongodb db (for persistence)
model
  L monbodb // mongodb model and schema
db
  L mongodb // mongodb connection and seeds
  L memory // simple array for dev purposes
server.js // express webserver and dependencies 
```
### Tutorial
We will approach authentication and authorization via the following steps:
1. Register user
2. Login and logout authentication
3. Flash messages
4. Authorization
5. Using it in routes

## 1. Register User
Passport.js is a library that makes it easier to handle session serialization, redirects and other aspects of authentication.

We will be using the `passport-local` strategy which is your vanilla username and password login strategy.

In the code below we we first start with the functionality to sign up a user. The local-signup strategy is middleware that our route will pass through. 

The first options that are passed tell passportJs that the email and password fields we are using differ from the default username field (in our case we use the name `email` in our form for username). The final field `passReqToCallback` lets us access the req object in the callback (which we will need to find other properties in the req.body e.g. the phone number).

The callback queries our DB to check if the user already exists, if it does then we return `done(null, false)` which will trigger the `failureRedirect`. If it doesn't then we create the user, hash the password using bcrypt and return `done(null, {id: newUser.id})`. By not passing false to the second param we trigger the `successRedirect` path. Here we pass the user_id to be serialized only into the session accessible via `req.user`, instead of passing the entire user object and passwordHash. You can pass anything you want, but we are passing only the id for security reasons.


```javascript
// auth/register.js
let register = module.exports = {}

// Dependecies
let bcrypt = require('bcrypt');
let passport = require('passport');
let LocalStrategy = require('passport-local').Strategy;
let User = require('../repositories/userRepository.js')

// =======USER SIGN UP AND HASH PASSWORD STRATEGY========
passport.use('local-signup', new LocalStrategy({
    usernameField: 'email', // map username to custom field, we call it email in our form
    passwordField: 'password',
    passReqToCallback: true // lets you access other params in req.body
  },
  async (req, email, password, done) => {
    // Return false if user already exists - failureRedirect
    let user = await User.findBy('email', email)
    if (user) { return done(null, false) }

    // Create new user and return the user - successRedirect
    let newUser = await User.create({
      email,
      passwordHash: bcrypt.hashSync(password, 10), // hash the password early
      phone: req.body.phone
    })

    // save the user_id to the req.user property
    return done(null, {id: newUser.id})
  }
))
```

Once we have our strategy we create two methods, 1 to render the signup form and the second to pass the forms payload to the passport signup strategy and handle the appropriate redirects.

```javascript
// auth/register.js

// GET route to render signup page
register.signupPage = (req, res, next) => {
  res.render('auth/signup')
}

// POST route to signup user and redirect 
register.signup = passport.authenticate('local-signup', {
  successRedirect: '/users/profile',
  failureRedirect: '/signup',
  failureFlash: {
    type: 'messageFailure',
    message: 'Email already taken.'
  },
  successFlash: {
    type: 'messageSuccess',
    message: 'Successfully signed up.'
  }
})

```
Later in our `routes/index.js` we will pass these two paths to:
```javascript
// routes/index.js
router
  .get('/signup', auth.signupPage)
  .post('/signup', auth.signup)

```

Visiting GET '/signup' will render the HTML signup form.

```html
// views/auth/signup
<h2>Signup</h2>

<form action="/signup" method="POST">
  <input type="email" placeholder="enter email" name="email" required>
  <br>
  <input type="password" placeholder="enter password" name="password" required>
  <br>
  <input type="tel" placeholder="enter phone" name="phone">
  <br>
  <input type="submit" value="Login">
</form>
```
Submitting the payload will then trigger the passport signup strategy and redirect accordingly. Passport.js enables us to set the success and failure flash messages in the passport.authenticate method. This is then accessible via `req.flash()`.

## 2. Login and Logout Authentication
Login and logout authentication follows the similar approach as registering new users.

We create a new `local-login` passport strategy which checks the DB if the user exists and if the submitted password matches the passwordHash in the DB (using bcrypt). If it does, we call done with the serialized user_id saved as a session in `req.user` and then trigger the `successRedirect` path. If not we call `done(null, false)` which triggers the `failureRedirect` path.

Similarly we create a loginPage path which renders the HTML login form and a method to handle the POST login request.

A logout path is straight forward, we call req.logout() which clears the session, we flash a message and redirect to a URL.

```javascript
//auth/logInOut.js
let logInOut = module.exports = {}

// Dependencies
let bcrypt = require('bcrypt');
let passport = require('passport');
let LocalStrategy = require('passport-local').Strategy;
let User = require('../repositories/userRepository.js')

// ======USER LOGIN AUTHENTICATION STRATEGY=======
passport.use('local-login', new LocalStrategy({
    // Fields to accept
    usernameField: 'email', // default is username, override to accept email
    passwordField: 'password',
    passReqToCallback: true // allows us to access req in the call back
  }, async (req, email, password, done) => {
    // Check if user and password is valid
    let user = await User.findBy('email', email)
    let passwordValid = user && bcrypt.compareSync(password, user.passwordHash)

    // If password valid call done and serialize user.id to req.user property
    if (passwordValid) {
      return done(null, {
        id: user.id
      })
    }
    // If invalid call done with false and flash message
    return done(null, false, {
      message: 'Invalid email and/or password'
    });
}))


// GET route to render login form view
logInOut.loginPage = (req, res, next) => {
  res.render('auth/login')
}

// POST route to handle req.body payload. Pass to passport login strategy with relevant redirects
logInOut.login = passport.authenticate('local-login', {
  successRedirect: '/',
  failureRedirect: '/login',
  failureFlash: {
    type: 'messageFailure',
    message: 'Invalid email and/ or password.'
  },
  successFlash: {
    type: 'messageSuccess',
    message: 'Successfully logged in.'
  }
})

// GET logout route, flash message and redirect
logInOut.logout = (req, res, next) => {
  req.logout();
  req.flash('messageSuccess', 'Successfully logged out')
  res.redirect('/login')
}

```

## 3. Flash messages
In order to display the flash messages we have been flashing above we need some middleware. This is a simple middleware that stores the success and failure flash messages in the gloal res.locals property. This makes it accessible in all our views via {{messageSuccess}} and {{messageFailure}}.

```javascript
//auth/middleware/flashMessageInviews.js
// global route middleware 
// success and failure flash message in views
module.exports = (req, res, next) => {
  res.locals.messageSuccess = req.flash('messageSuccess')
  res.locals.messageFailure = req.flash('messageFailure')
  next();
}
```

In addition in order to know if someone has logged in or not we use another middleware to check if the user is authenticated. This lets us be able to display either login or logout links depending if someone is logged in or out.

```javascript
//auth/middleware/userInViews.js
// global route middleware 
// user boolean accessible in views if authenticated
module.exports = (req, res, next) => {
  res.locals.user = req.isAuthenticated()
  next()
}
```

To use these we need to call it in our main server.js file.
```javascript
//server.js
// Custom middleware authentication and flash message view middleware
app.use(userInViews)
app.use(flashMessageInViews)

// Routes
app.use(require('./routes/index'))
const userInViews = require('./auth/middleware/userInViews.js')
const flashMessageInViews = require('./auth/middleware/flashMessageInViews.js')
```

Now in our view layout template we can display our flash messages and appropriate login or logout links.

```handlebars
//views/layouts/main.hbs
  <h1>Web App</h1>
  <div style="background-color: red">    
    {{messageFailure}}
  </div>
  <div style="background-color: green">    
    {{messageSuccess}}
  </div>
  
  <nav>
    <p>
      {{#if user}}
        <a href="/logout">Logout</a>
      {{else}}
        <a href="/login">Login</a>
      {{/if}}
      
      <a href="/signup">Signup</a>
    </p>
```

## 4. Authorization
Authorization middleware lets us gate certain routes depending on a users authentication and permission level. In addition it can then redirect to specific pages with appropriate flash messages.

In our example we use three forms of authorization:
- loginRequired: needs to be logged in otherwise redirect to login page
- adminRequired: needs to be an admin: true user otherwise redirects to profile page
- signupRequired: same as loginRequired except redirects to signup page

```javascript
//auth/authorization.js
let authorization = module.exports = {}

let User = require('../repositories/userRepository')

// Higher order function to keep DRY
let authenticate = ({type, message, redirectPath}) => {
  return (req, res, next) => {
    let isAuthenticated = req.isAuthenticated()
    if (!isAuthenticated) {
      req.flash(type, message)
      return res.redirect(redirectPath)
    }
    next()
  }
}

// ===AUTHORIZATION MDDLEWARE
authorization.loginRequired = authenticate({
  type: 'messageFailure',
  message: 'Must be logged in',
  redirectPath: '/login'
})

authorization.signupRequired = authenticate({
  type: 'messageFailure',
  message: 'Must be signed up',
  redirectPath: '/signup'
})


authorization.adminRequired = async (req, res, next) => {
  let id = req.user && req.user.id
  let user = await User.findBy('id', id)
  let isAdmin = user && user.admin

  if (!isAdmin) {
    req.flash('messageFailure', 'Admin only')
    return res.redirect('/users/profile')
  }

  next();
}
```

## 5. Using it in routes
Now we have our logic and flash views ready we can integrate to our routes/index file. This should be self explanatory.

```javascript
const express = require('express')
let router = express.Router()

// === AUTH ENDPOINTS ===
const auth = require('../auth')
router
  .get('/login', auth.loginPage)
  .post('/login', auth.login)
  .get('/signup', auth.signupPage)
  .post('/signup', auth.signup)
  .get('/logout', auth.logout)

// === BOILERPLATE === 
// pages endpoints
let pages = require('./pages')

router
  .get('/', pages.home)
  .get('/admin', auth.loginRequired, auth.adminRequired, pages.admin)
  .get('/special', auth.signupRequired, pages.special)
  
// users endpoints
let users = require('./users')
router
  .get('/users/profile', auth.loginRequired, users.show)
  .get('/users', auth.loginRequired, auth.adminRequired, users.index)

module.exports = router
```

## How to use this demo app
This demo app can be used as boilerplate authentication for other apps.

To reuse follow these steps:
1. Ensure you have the minimum dependencies installed (see above)
2. Copy the entire auth folder
3. Create an auth folder in your views to render the appropriate login and signup page (customise depending on form fields)
4. Modify the userRepository in order to create and read user details
6. Update your routes/index file to include the auth routes and use the appropriate auth authorization middleware for your specific routes
7. Update your server.js file to include the relevant authentication dependencies (order matters)

Learn how to handle web authentication and authorization in Node using Passport.js. Create signup and login page, different types of users and handle authentication for specific pages.

Howie Mann
Startup & Investing Advice
About Articles Stocks

Articles > security

How to Deploy a Node App to AWS EC2

Express Validation and Error Handling

Node.js Authentication Tutorial with Passport

Howie MannStartup & Investing AdviceAboutArticlesStocks

Articles > security

How to Deploy a Node App to AWS EC2

Express Validation and Error Handling

Node.js Authentication Tutorial with Passport

Howie Mann
Startup & Investing Advice
About Articles Stocks