Why is PassportJS in Node not removing session on logout

Question

I am having trouble getting my system to log out with PassportJS. It seems the logout route is being called, but its not removing the session. I want it to return 401, if the user is not logged in in specific route. I call authenticateUser to check if user is logged in.

Thanks a lot!

/******* This in index.js *********/ // setup passport for username & passport authentication adminToolsSetup.setup(passport);  // admin tool login/logout logic app.post("/adminTool/login",     passport.authenticate('local', {         successRedirect: '/adminTool/index.html',         failureRedirect: '/',         failureFlash: false }) ); app.get('/adminTool/logout', adminToolsSetup.authenticateUser, function(req, res){     console.log("logging out");     console.log(res.user);     req.logout();     res.redirect('/'); });   // ******* This is in adminToolSetup ******** // Setting up user authentication to be using user name and passport as authentication method, // this function will fetch the user information from the user name, and compare the password     for authentication exports.setup = function(passport) {     setupLocalStrategy(passport);     setupSerialization(passport); }  function setupLocalStrategy(passport) {     passport.use(new LocalStrategy(         function(username, password, done) {             console.log('validating user login');             dao.retrieveAdminbyName(username, function(err, user) {                 if (err) { return done(err); }                 if (!user) {                     return done(null, false, { message: 'Incorrect username.' });                 }                 // has password then compare password                 var hashedPassword = crypto.createHash('md5').update(password).digest("hex");                 if (user.adminPassword != hashedPassword) {                     console.log('incorrect password');                     return done(null, false, { message: 'Incorrect password.' });                 }                 console.log('user validated');                 return done(null, user);             });         }     )); }  function setupSerialization(passport) {     // serialization     passport.serializeUser(function(user, done) {         console.log("serialize user");         done(null, user.adminId);     });      // de-serialization     passport.deserializeUser(function(id, done) {         dao.retrieveUserById(id, function(err, user) {             console.log("de-serialize user");             done(err, user);         });     }); }  // authenticating the user as needed exports.authenticateUser = function(req, res, next) {     console.log(req.user);     if (!req.user) {         return res.send("401 unauthorized", 401);     }     next(); } 

Answer 1

Brice’s answer is great, but I still noticed an important distinction to make; the Passport guide suggests using .logout() (also aliased as .logOut()) as such:

app.get('/logout', function(req, res){   req.logout();   res.redirect('/'); //Can fire before session is destroyed? }); 

But as mentioned above, this is unreliable. I found it behaved as expected when implementing Brice’s suggestion like this:

app.get('/logout', function (req, res){   req.session.destroy(function (err) {     res.redirect('/'); //Inside a callback… bulletproof!   }); }); 

Hope this helps!