title: Express user authentication middleware, how much should it do?
body: <p>I'm trying to learn Express session and authentication handling. </p>
  
  <p>For example:</p>
  
  <pre><code>app.post('/login', authCredentials, function(req, res) {
     console.log("second")
  });
  
  function authCredentials(req, res, next) {
    //this happens first
    console.log(req.body) // =&gt; { username: etc, password: etc }
    next(); 
  }
  </code></pre>
  
  <p>My question is just how much should my <code>authCredentials</code> function do?
  For example if the credentials are correct, I can do something like
  <code>res.redirect('/index')</code>. Once I do that, however, what purpose does the second function have? </p>
  
  <p>Other questions:</p>
  
  <ol>
  <li>How would I handle invalid credentials?</li>
  <li>If I make <code>authCredentials</code> just return <code>true</code> or <code>false</code> depending on the credentials, doesn't that break the middleware flow because it would never invoke <code>next()</code>?</li>
  <li>Is it possible to access anything in <code>authCredentials</code> in the anonymous callback after it? Basically in the <code>function(req, res) { }</code>?</li>
  </ol>