我也遇到了同样的问题。我通过将validatePassword方法从用户模式移到passport策略来解决我的问题。看起来密码没有被传递到UserSchema中的validatePassword方法。

// Pulling in required dependencies
const mongoose = require('mongoose');
const bcrypt   = require('bcrypt-nodejs');
const Schema = mongoose.Schema;

//Creat UserSchema
const UserSchema = new Schema({
    local: {
        email: String,
        password: String
    },
    role: {
        type: String,
        default: 'user',
    },
    books_downloaded: {
        booksId: {
            type: Array,
            required: false,
        },
    },
    books_needed: {
        type: Object,
        default: null,
    },
    created_at: {
        type: Date,
        default: Date.now,
    },
});

// methods=====================================================
// generating a hash
UserSchema.methods.generateHash = (password) => {
    return bcrypt.hashSync(password, bcrypt.genSaltSync(8), null);
}

// expose User model to the app
module.exports = mongoose.model('User', UserSchema);

"这是我的护照策略"

// load all the things we need
const LocalStrategy = require('passport-local').Strategy;
const bcrypt   = require('bcrypt-nodejs');

//load up the user model
const User = require('../models/User');

// expose this function to our app
module.exports = passport => {
    /**
     * passport session setup =======================
     * required for persistent login sessions
     * serialize and unserialize users out of session
     */
    //serialize the user for the session
    passport.serializeUser((user, done) => {
        done(null, user.id);
    });

    //deserialize the user
    passport.deserializeUser((id, done) => {
        User.findById(id, (err, user) => {
            done(err, user);
        });
    });

    /**
     * LOCAL SIGNUP
     * using named strategies
     */
    // local signup
    passport.use(
        'local-signup',
        new LocalStrategy(
            {
                usernameField: 'email',
                passwordField: 'password',
                passReqToCallback: true,
            },
            (req, email, password, done) => {
                process.nextTick(() => {

                    // find a user whose email is the same as the forms email
                    User.findOne({ 'local.email': email }, (err, user) => {
                        if (err) return done(err);
                        // check to see if theres already a user with that email
                        if (user) {
                            return done(null, false, req.flash('signupMessage', 'That email is already taken.'));
                        } else {
                            // if there is no user with that email
                            // create the user
                            var newUser = new User();

                            // set the user's local credentials
                            newUser.local.email = email;
                            newUser.local.password = newUser.generateHash(password);

                            // save the user
                            newUser.save(err => {
                                if (err) throw err;
                                return done(null, newUser);
                            });
                        }
                    });
                });
            }
        )
    );

    // =========================================================================
    // LOCAL LOGIN =============================================================
    passport.use(
        'local-login',
        new LocalStrategy(
            {
                usernameField: 'email',
                passwordField: 'password',
                passReqToCallback: true,
            },
            (req, email, password, done) => {

                // checking to see if the user trying to login already exists
                User.findOne({ 'local.email': email }, function(err, user) {
                    // if there are any errors, return the error before anything else
                    if (err) return done(err);

                    // if no user is found, return the message
                    if (!user) return done(null, false, req.flash('loginMessage', 'No 
                     user found.'));

                    // if the user is found but the password is wrong
                        let correctPassword = 
                  bcrypt.compareSync(password,user.local.password);

                    if (!correctPassword)
                        return done(null, false, req.flash('loginMessage', 'Oops! 
                  Wrong password.'));

                    // If all is well, return successful user
                    return done(null, user);
                });
            }
        )
    );
};

我重写了大部分的脚本，现在它可以工作了！下面是代码。

const express = require ('express');
const session = require ('express-session');
const bodyParser = require ('body-parser');
const cookieParser = require ('cookie-parser');
const mongoose = require ('mongoose');
const passport = require ('passport');
const LocalStrategy = require ('passport-local').Strategy;
const User = require ('./UserModel');

const dbUrl = 'url';
const port = process.env.PORT || 9000;
const app = express ();

app.use (bodyParser.json ());
app.use (bodyParser.urlencoded ({extended: true}));
app.use (cookieParser ());
app.use (
  session ({secret: 'borkar.amol', saveUninitialized: false, resave: false})
);

app.use (passport.initialize ());
app.use (passport.session ());

mongoose.connect (dbUrl, {useNewUrlParser: true}, () => {
  console.log ('Successfully connected to hosted database.');
});

passport.serializeUser ((User, done) => {
  //console.log ('SERIALIZEUSER: ', User._id);
  done (null, User._id);
});

passport.deserializeUser ((id, done) => {
  User.findById (id, (err, User) => {
    //console.log ('DESERIALIZEUSER: ', User);
    done (err, User);
  });
});

passport.use (
  'signup',
  new LocalStrategy (
    {
      usernameField: 'email',
      passwordField: 'password',
    },
    (email, password, done) => {
      process.nextTick (() => {
        User.findOne ({email: email}, (err, foundUser) => {
          if (err) return done (err);

          if (foundUser) {
            return done (null, false, {
              message: 'The email is already registered.',
            });
          } else {
            let newUser = new User ();
            newUser.email = email;
            newUser.password = newUser.hashPassword (password);

            newUser.save (err => {
              if (err) console.error ('Error when writing to database', err);
            });

            return done (null, newUser, {
              message: 'User has been registered successfully.',
            });
          }
        });
      });
    }
  )
);

passport.use (
  'login',
  new LocalStrategy (
    {
      usernameField: 'email',
    },
    (email, password, done) => {
      User.findOne ({email: email}, (err, foundUser) => {
        if (err) return done (err);

        if (!foundUser) {
          return done (null, false, {
            message: 'Invalid Username or Password.',
          });
        }

        if (!foundUser.comparePassword (password)) {
          return done (null, false, {
            message: 'Invalid Username or Password.',
          });
        }

        return done (null, foundUser);
      });
    }
  )
);

//Routes --->

app.get ('/user', (req, res, next) => {
  if (req.isAuthenticated ()) {
    res.json ({user: req.user});
    return next ();
  }

  res.status (400).json ({message: 'Request is not authenticated.'});
});

app.post (
  '/signup',
  passport.authenticate ('signup', {
    successRedirect: '/user',
    failureMessage: true,
    successMessage: true,
  })
);

app.post (
  '/login',
  passport.authenticate ('login', {
    successRedirect: '/user',
    failureMessage: true,
    successMessage: true,
  })
);

app.post ('/logout', (req, res) => {
  if (req.user) {
    req.session.destroy ();
    req.logout ();
    res.clearCookie ('connect.sid');
    return res.json ({message: 'User is now logged out.'});
  } else {
    return res.json ({message: 'Error: No user to log out.'});
  }
});

app.listen (port, () => {
  console.log (`Started listening on PORT: ${port}`);
});

将其定义为函数
之前

userSchema.methods.validPassword = password => {
  return bcrypt.compareSync(password, this.local.password);
};

之后

userSchema.methods.validPassword = function (password) {
  return bcrypt.compareSync(password, this.local.password);
};

我不知道为什么它不能与箭头回调一起工作

“在传统函数表达式中，“this”关键字根据调用它的上下文绑定到不同的值。但是，对于箭头函数，这是按词汇绑定的。这意味着它使用包含箭头函数的代码中的“this”。”-引用自freeCodeCamp
在这里，我们使用userSchema中的“this”，而不是arrow函数本身中的“this”。因此，您应该将arrow函数更改为经典函数表达式。