node.js - Passport-http bad request -

i wanna make simple authentication passport-http (digeststrategy). like:

var digeststrategy = require('passport-http').digeststrategy;  passport.use('login', new digeststrategy({ qop: 'auth' },     function(login, password, done) {         user.findone({ login: login }, function(err, user) {             if (err) { return done(err); }             if (!user) { return done(null, false); }             user.matchpassword(password, function(err, ismatch) {                 if (!ismatch)                 {                     return done(null, false);                 }                 return done(null, user);             })         });     } )); 

and in post /login

router.post('/',     passport.authenticate('login', {session: false}),     function(req, res) {         if (req.user)         {             var expires = moment().add('hours', 1).valueof();              res.json({                 expires: expires,                 user: req.user.tojson()             });         }          else         {                console.log("send 401 ...");             res.sendstatus(401);         } }); 

i insert credentials in http form

div.loginbox     form(name='login', action='/login', method='post')         label(value='login')         input(type='text', name='login')          label(value='password')         input(type='password', name='password')          input(type='submit', value='login') 

but after that, 400 bad request.

actually, mixing http authentication custom authentication posting form data credentials.

by posting credentials using html form there no implicit http digest authentication. need send special headers initiating http authentication. there can choose basic or digest authentication. causing browser prompt user name , password resulting in special http header managed chosen digeststrategy. bad request issued http header missing required header information performing authentication.

if want log in using form either might want use localstrategy of passport-local instead or use ajax managing client-side digest authentication though i'd stick former.