Passport Nodejs - logout from previous sessions

Question

sorry for silly question I'm using passport for authentication purpose. I wanted to logout from previous sessions (be it on different browser or device) when user tries to login with new session.

I know I can user req.logout to log out but I'm not sure how to destroy all other sessions from db which my passport is creating while login.

Even if I manually delete them, I'm not auto logging out

The following is my passport config

const passport = require('passport'),
    LocalStrategy = require('passport-local').Strategy,
    User = require('../database/Schema').User,
    shortid = require('shortid');

passport.serializeUser( (user, cb) => {
    cb(null, user);
});

passport.deserializeUser( (obj, cb) => {
    cb(null, obj);
});

passport.use('localRegister', new LocalStrategy({
        usernameField: 'email',
        passwordField: 'password',
        passReqToCallback: true
    },
    (req, email, password, done) => {
        User.findOne({$or: [{email: email}, {username: req.body.username}]},  (err, user) => {
            if (err)
                return done(err);
            if (user) {
                if (user.email === email) {
                    req.flash('email', 'Email is already taken');
                }
                if (user.username === req.body.username) {
                    req.flash('username', 'Username is already taken');
                }

                return done(null, false);
            } else {
                let user = new User();
                user.email = email;
                user.password = user.generateHash(password);
                user.username = req.body.username;
                user.stream_key = shortid.generate();
                user.save( (err) => {
                    if (err)
                        throw err;
                    return done(null, user);
                });
            }
        });
    }));

passport.use('localLogin', new LocalStrategy({
        usernameField: 'email',
        passwordField: 'password',
        passReqToCallback: true
    },
    (req, email, password, done) => {

        User.findOne({'email': email}, (err, user) => {
            if (err)
                return done(err);

            if (!user)
                return done(null, false, req.flash('email', 'Email doesn\'t exist.'));

            if (!user.validPassword(password))
                return done(null, false, req.flash('password', 'Oops! Wrong password.'));

            return done(null, user);
        });
    }));


module.exports = passport;

---

The following is my user schema (I'm using mongodb)

let mongoose = require('mongoose'),
    bcrypt   = require('bcryptjs'),
    shortid = require('shortid'),
    Schema = mongoose.Schema;

let UserSchema = new Schema({
    username: String,
    email : String,
    password: String,
    stream_key : String,
});

UserSchema.methods.generateHash = (password) => {
    return bcrypt.hashSync(password, bcrypt.genSaltSync(8));
};

UserSchema.methods.validPassword = function(password){
    return bcrypt.compareSync(password, this.password);
};

UserSchema.methods.generateStreamKey = () => {
    return shortid.generate();
};

module.exports = UserSchema;

---

The following is my login route

const express = require('express'),
    router = express.Router(),
    passport = require('passport');

router.get('/',
    require('connect-ensure-login').ensureLoggedOut(),
    (req, res) => {
        req.logOut();
        res.render('login', {
            user : null,
            errors : {
                email : req.flash('email'),
                password : req.flash('password')
            }
        });
    });

router.post('/', passport.authenticate('localLogin', {
    successRedirect : '/',
    failureRedirect : '/login',
    failureFlash : true
}));

module.exports = router;

Answer 1

You can use Express-session package for store the value in databases. Because Express-session delete the value automatically from database after expire time. https://www.npmjs.com/package/express-session

Answer 2

according to the source file, logout session manager, you can add key keepSessionInfo as option.

//https://github.com/jaredhanson/passport/blob/master/lib/sessionmanager.js#L83-L91
req.session.regenerate(function(err) {
  if (err) {
    return cb(err);
  }
  if (options.keepSessionInfo) {
    merge(req.session, prevSession);
  }
  cb();
});

that function also applied to login.

it would be like:

passport.authenticate('actionName', {
  ...,
  keepSessionInfo : false
})

in your case, you better to put it on action login, because logout will delete the last one session as well.

base on your code, it would be:

router.post('/', passport.authenticate('localLogin', {
    successRedirect : '/',
    failureRedirect : '/login',
    failureFlash : true,
    keepSessionInfo : false //added here.
}));