A developer discovers authentication code that misuses Passport.js by manually re-implementing password validation in a callback that only executes when authentication already failed. The logic contains an impossible branch where successful password verification still returns an error message, making it impossible for users to log in. The code also incorrectly invokes passport.authenticate from within controller code rather than as route middleware.
1.4K Impressions