node.js - passport.authenticate not working as expected -

Strange behavior, here. When I hit / login with the correct username / password combo, it actually sends me / secret passage when I use the wrong combination, then it's right back to my right where I started Had redirection there.

However, if I try to "lock down" a route, say:

  app.get ('/ mySecretRoute', passport.authenticate ( 'Local'), function (Rick, race, next) {res.json ({test: "secret"}}};   
 Then I have a  401: unauthorized < / Code> if I try to hit it after entering, it seems that a cookie is actually set, but probably is not correct. I have verified that the user is in the local strategy Has come, and this serialization captures the right user.  How can I configure the passport correctly and lock the routes to use the local strategy?  I have seen through the medium and it seems that I am following the instructions.  
  / / all environment app.set ('port', process.env.port || 3000); App .set ('idea', path .jound (__deirnam, 'idea')); app.set ('visual engine', 'z'); app.use (express.fa Vicon (); app.use (express.logger ('dev')); App.use (express.json ()); App.use (express.urlencoded ()); App.use (express.methodOverride ()); App.use (passport.initialize ()); App.use (passport.session ()); App.use (app.router); App Use (express.static (path.join (__derename, 'public')); Mongoose.connect (config.mongo.host + ':' + config.mongo.port + '/' + config.mongo.db_name); App.get ('/', routes.index); App.get ('/ secret', function (req, res, next) {res.render ("secret");}); App.get ('/ login', function (Rick, Race, Next) {res.render ("Login");}); APPOST ('/ login', passport. Authentication ('local', {success redirect: '/ secret', failureRedirect: '/'})); App.get ('/ register', function (req, res, next) {res.render ('register');}); App.post ('/ register', register); Passport.use (new user name (function (username, password, done) {User.findByU name (username, function (error, user) {console.log (username); if (mistake) {return complete (mistake) );} If (user!) {Return complete (empty, false, {message: 'wrong username'}}}} if (! User.valid password (password)) {return complete (empty, false, {message: 'Wrong password.'});} Returned (tap, user);});})); Passport serialize user (function (user, done) {console.log (user._id); did (tap, user ._id);}); Passport.deserialize user (work (id, done) {User.findById (id, function (error, user) {done (err, user);})}}; Function Register (Rick, Race, Next) {console.log (req.body.username); Console.log (req.body.password); User.addUser (req.body.username, req.body.password, function (mistake) {if (mistake) throws new errors;}); } Http.createServer (list) .listen (app.get ('port'), function () {console.log ('listen to express server on port' + app.get ('port'));};  
 
 For the most part, what I originally posted works just fine.  
 Despite the lack of good documentation on the passport site, I was able to make a simple middleware to check that the user is logged in:  
  export.loggedIn = Function (req, res, next) {Console.log ('checking credentials ...'); Console.log (req.user); If (req.isAuthenticated ()) {next (); } Other {res.redirect ("/"); }};   
 I'm not sure that this is the best way to do this, but req.is is authorized by the passport, so it should be somewhat standard.