bad auth for shared js

client.js

// even though the dangerous auth is fine on client
var cu = require('dangerous-auth').get();

// need to instead shim a context to maintain same api
// to resolve routes etc, sometime need access to context
// var context = {};

dangerous-auth.js

var currentUser;

module.exports.get = function() {
  return currentUser;
};

module.exports.set = function(user) {
  currentUser = user;
}

server.js

// this is dangerous on server, since node shares / caches variables
app.use(function(req, res) {
  require('dangerous-auth').set({ name: 'nick' });
  // ...
});

// instead you should use context
app.use(function(req, res) {
  req.context = req.context || {};
  req.context.currentUser = { name: 'nick' };
  // ...
});