server_session.js

// using bcrypt
const express = require("express");
const bodyParser = require("body-parser");
const mongoose = require("mongoose");
const bcrypt = require('bcrypt');
const sessions = require("client-sessions");
const saltRounds = 10;

const app = express();

mongoose.connect("mongodb://localhost:27017/userDB", {
    useNewUrlParser: true,
    useUnifiedTopology: true
});

const UserSchema = new mongoose.Schema({
    email: {
        type: String,
        required: true,
        unique: true
    },
    password: {
        type: String,
        required: true
    }
});



const User = mongoose.model("User", UserSchema);

// urlencoded parser is used since the html form send data
// as urlencoded format with POST reqiest
app.use(bodyParser.urlencoded({ extended: true }));
app.use(sessions({
    cookieName: 'mySession', // cookie name dictates the key name added to the request object
    secret: 'mt-top-secret-encription-key-should-be-in-.env-file', // should be a large unguessable string
    duration: 60 * 1000, // how long the session will stay valid in ms
}));

app.get("/", function(req, res) {
    res.redirect("/register");
});

// define the register GET route
app.get("/register", function(req, res) {
    res.sendFile(__dirname + "/register.html");
});

// define the login GET route
app.get("/login", function(req, res) {
    res.sendFile(__dirname + "/signin.html");
});

// define the register POST route
app.post("/register", function(req, res) {
    const email = req.body.email;
    const password = req.body.password;
    bcrypt.hash(password, saltRounds, function(err, hash) {
        const newUser = User({ email: email, password: hash });
        newUser.save(function(err) {
            if (!err) {
                res.redirect("/login");
            } else {
                res.send(err);
            }
        });
    });
});

// define the login POST route
app.post("/login", function(req, res) {
    const email = req.body.email;
    const password = req.body.password;
    User.findOne({ email: email }, function(err, user) {
        if (err) {
            res.send(err);
        } else if (user) {
            bcrypt.compare(password, user.password, function(err, result) {
                if (err) {
                    res.send(err);
                } else {
                    if (result === true) {
                        req.mySession.user = user;
                        res.sendFile(__dirname + "/secret.html");
                    } else {
                        res.redirect("/login")
                    }
                }
            });

        } else {
            res.redirect("/login");
        }
    });
});

///////////////////This is our secret page/////////////////////

// define the secret route
app.get("/secret", function(req, res) {
    if (req.mySession && req.mySession.user) {
        res.sendFile(__dirname + "/secret.html");
    } else {
        res.redirect("/login");
    }

});


app.listen(3000, function() {
    console.log(`Server started at port ${3000}`);
});