This guide details the logic for implementing a secure, session-based user login system using Node.js, Mongoose and Bcrypt.

1. Database Lookup

When a user submits their credentials, the system queries MongoDB to locate the user profile.

Method: findOne({ username }) via Mongoose.

Security Rule: If the username does not exist, halt execution immediately. Return a 401 Unauthorized status.