Secure Login & Error Handling
A production-ready login route with explicit errors, bcrypt, and httpOnly cookie-based session tokens.
router.post('/login', async (req, res) => {
const { email, password } = req.body;
try {
const user = await User.findOne({ email });
if (!user) return res.status(404).json({ msg: 'USER_NOT_FOUND' });