title: How to Check Current Password And (If Correct) Update Password Using Passport.js Local Strategy
body: <p>I need to write commonplace code to check a Current User Password value submitted via form to see if it matches the existing password in the database, and if so, update the password to a New Password value that was submitted via the same form.  </p>
  
  <p>Yet, I can't find any good examples of how to do this using Passport.js.  Can anyone advise as to how I can do this in my Users controller down below, if there are any helper functions provided by passport that I should use for this, and how I do this with hashed and salted passwords?</p>
  
  <p><strong>Here is my code:</strong></p>
  
  <pre><code>  // Form Submitted
    req.body = { 
       _id: '5294198b7b35ad2794000001',
       email: 'testusera1@abc.net',
       name: 'John Smith',
       provider: 'local',
       username: 'ab123',
       current_password: 'currentpassword',
       new_password: 'newpassword'
    }
  
  // Route
    app.put('/users/me', users.update);
  
  
  // Controller
    var mongoose    = require('mongoose'),
      User          = mongoose.model('User'),
      _             = require('underscore'),
      passport      = require('passport'),
      LocalStrategy = require('passport-local').Strategy;
  
    exports.update = function(req, res) {
      var user = req.user
      user     = _.extend(user, req.body);
      user.save(function(err) {
          if(err) { console.log(err) };
          res.jsonp(user);
      });
    };
  
  
  // Passport Config File
    module.exports = function(passport) {
      //Serialize sessions
      passport.serializeUser(function(user, done) {
          done(null, user.id);
      });
  
      passport.deserializeUser(function(id, done) {
          User.findOne({
              _id: id
          }, function(err, user) {
              done(err, user);
          });
      });
  
      //Use local strategy
      passport.use(new LocalStrategy({
              usernameField: 'email',
              passwordField: 'password'
          },
          function(email, password, done) {
              User.findOne({
                  email: email
              }, function(err, user) {
                  if (err) {
                      return done(err);
                  }
                  if (!user) {
                      return done(null, false, {
                          message: 'Unknown user'
                      });
                  }
                  if (!user.authenticate(password)) {
                      return done(null, false, {
                          message: 'Invalid password'
                      });
                  }
                  return done(null, user);
              });
          }
      ));
    };
  </code></pre>