mongodb - req.user being set to first user in database when trying to log in // Express, Node.js -

i'm working on application using node.js express framework, using passport user authentication , mongodb storage. i'm having trouble figuring out why no matter user tries log in, server decides logged-in user first user in database, i.e. first user signed up.

when server receives post request /login, runs passport.authenticate authenticate user's credentials. logging out console, it's clear proper user credentials passed through, , session id correct, wherever req.user set, being set wrong user.

here log in console of what's happening give idea:

get /user --req.user { salt: '$2a$10$ngpcbpvuqgq32iowvschd.',   hash: '$2a$10$ngpcbpvuqgq32iowvschd.syva2e/aapsfucdn65arm/d1oyjb3ty',   username: 'daniel',   email: 'dan@dan.com',   _id: 515decd49fc3204ca1000001,   __v: 0,   songs: [] } --req.session { cookie:    { path: '/',      _expires: null,      originalmaxage: null,      httponly: true },   passport: { user: '515decdc9fc3204ca1000002' },   flash: {} } 

as can see, user id correct in req.sessions incorrect in req.user.

the full code available here: https://github.com/patrickmestabrook/song-swap

i guess serialize/deserialize process. have tried using _id.tostring() in serializeuser method?

have verified correct user being returned inside models.js?

schemas.user.static('authenticate', function( username, password, done) {   console.log('schemas.user.static.authenticate');   console.log('-username ' + username);   console.log('-password ' + password);     this.findone({ username: username }, function( err, user ) {     console.log('this.findone inside authenticate, callback');     console.log('user.username ' + user.username);      if ( err   ) return done( err );     if ( !user ) return done( null, false );     user.verifypassword( password, function( err, passwordcorrect) {         if ( err ) return done( err );       if ( !passwordcorrect ) { return done( null, false ); }       // return done( null, user );       done ( null, user );     })   }) }) 

also check correct username , password being passed authenticate method

passport.use(new localstrategy(function( username, password, done ) {     console.log('username: ' + username)   console.log('password: ' + password)   models.user.authenticate( username, password, function( err, user) {     // right now, reports wrong user dammit     console.log('models.user.authenticate callback');     console.log('--username ' + user.username);     // return done( err, user );     done( err, user);   });  }));