Pfthb

Im not sure if this express-session auth method is secure. I encrypt the password using bcryptjs and after encrypting I set the req.session.isLoggedIn = true in admin.js and later check it in events.js by using an if statement. Is the if statement method in events.js secure or somehow breachable? Is there an better option?
I'm using handlebars to render the web pages.

admin.js

bcrypt.compare(pass, user.password).then((doMatch) => 
 console.log(doMatch);
 //Check if password match
 if (doMatch) 
 //setting the isLoggedIn value
 req.session.isLoggedIn = true;
 //Events is the route that requires authentication
 return res.redirect('/events');
 else 
 res.redirect('/');
 
 ).catch((err) => 
 console.log(err);
 );

events.js

Router.get('/', (req, res) => 
//Checking the if the loggedIn value is true
if (req.session.isLoggedIn) 
Event.find(, (err, events) => 
 res.render('events', 
 prods: events,
 pageTitle: 'Events',
 path: '/events',
 hasProducts: events.length > 0
 );
).catch((err) => 
 console.log(err);
);
 else 
 console.log('User not authenticated');
 res.status(404).send(error: 'not authorized!');


);

I don't think this is the best method you should take a look at : http://www.passportjs.org/

They have a good documentation about authentication strategies and registration also many other methods(Facebook login, Twitter...) also there is many tutorials on how you can implement Passport.js

Hope it helps you !