title: passport req.isAuthenticated always return false when using angular $http request
body: <p>I am using passportjs for my user authentication. </p>
  
  <p><strong>By using postman</strong>, I can successfully login and req.isAuthenticated always returns me true in the subsequence requests after login. </p>
  
  <p><strong>By using angular $http</strong>, However, login works ok but the req.isAuthenticated always returns me false in the subsequence request. My <strong>angular app(localhost:3000)</strong> and the <strong>node app(heroku)</strong> are at different domain. My thoughts was it may relate to either CORS or session cookie since I do not see any cookies in my browser.</p>
  
  <p><strong>What I have done</strong></p>
  
  <ol>
  <li>I tried to set the request header to allow CORS.</li>
  <li>I also tried to set <strong>Access-Control-Allow-Credentials</strong> at both angular $http and node app.</li>
  </ol>
  
  <p>Unfortunately, all attempts fail T_T</p>
  
  <p><strong>Nodejs settings</strong></p>
  
  <pre><code>    app.use(function(req, res, next) {
          res.header('Access-Control-Allow-Credentials', true);
          res.header('Access-Control-Allow-Origin', req.headers.origin);
          res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
          res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept');
          if ('OPTIONS' == req.method) {
              res.send(200);
          } else {
              next();
          }
      });
  
      passport.serializeUser(function(account, done) {
          done(null, account.id);
      });
  
      // used to deserialize the user
      passport.deserializeUser(function(id, done) {
          Account.findById(id, function(err, account) {
              done(err, account);
          });
      });
  
      passport.use('local-signup', new LocalStrategy({
          usernameField: 'email'
      }, function(email, password, done) {
          ....
      }));
  
      passport.use('local-login', new LocalStrategy({
          usernameField: 'email'
      }, function(email, password, done) {
          ....
      }));
  
      app.use(morgan('dev')); // log every request to the console
  
      app.use(bodyParser.urlencoded({ extended: false }));
  
      app.use(bodyParser.json());
  
      app.use(cookieParser(config.app.sessionSecret));
  
      app.use(session({
          secret: config.app.sessionSecret,
          resave: false,
          saveUninitialized: true,
          cookie: { httpOnly: true, maxAge: 2419200000 }
      }));
  
      // Passport for account authentication
      app.use(passport.initialize());
      app.use(passport.session()); // persistent login sessions
  
      ///////////////////////////////////////////////////////////////////route controller function
      authenticate: function(req, res) {
          if (!req.isAuthenticated()) {
              res.redirect('/login');
          } else {
              res.status(200).send('successful');
          }
      }
  </code></pre>
  
  <p><strong>Angular</strong></p>
  
  <pre><code>    $http.post('http://xxxxx/login', 
        {  email: $scope.user.email,
           password: $scope.user.password
        })
      .then(function(response) {
          ...
      }, function(response) {
          ...
      });
  
      $http.get('http://xxxxx/authenticate',
          { withCredentials: true }).success(function() {
              ...
          })
          .error(function() {
              ... // always get here with 302 redirect
          });
  </code></pre>
  
  <p><strong>My questions/things I do not understand</strong></p>
  
  <ol>
  <li>Is that because session cookie is not set in the browser causing the problem</li>
  <li>If it relates to CORS, did I miss any settings?</li>
  <li>What else????</li>
  </ol>