//passport.js

passport.use(new BoxStrategy({
    clientID: config.box.boxClientID,
    clientSecret: config.box.boxClientSecret,
    callbackURL: config.box.boxCallbackURL
  },
  function(accessToken, refreshToken, profile, done) {
    // asynchronous verification, for effect...
    process.nextTick(function () {

      // To keep the example simple, the user's Box profile is returned to
      // represent the logged-in user.  In a typical application, you would want
      // to associate the Box account with a user record in your database,
      // and return that user instead.
      return done(null, profile);
    });
  }
));

//session.js

exports.boxLogin = function(req, res, next) {
  console.log('box auth');
  passport.authenticate('box'), function(req, res) {
    // The request will be redirected to Box for authentication, so this
    // function will not be called.
  }
};

exports.boxLoginCallback = function(req, res, next) {
  console.log('box login callback');
  app.get('/auth/box/callback',
  passport.authenticate('box', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });
};