net-36 | Encodes base to base 36 and decodes base 36 to base | DevOps library

You are registering event handlers for every request. The problem is, you're not removing any of the request handlers afterwards.

For example, if you did 10 POST requests to the login endpoint, and then you do the 11th. If the 11th's is successful, the success event is triggered for the current request but also all the other 10.

The reason you're getting Cannot set headers after they are sent to the client is because the event listener is being triggered for a HTTP request that already completed.

The solution is to architect this different. The EventListener is not a good model for calling functions and getting results. EventListener is good for things that can trigger many times. In this case you don't want that, you only want 1 success or 1 failure per request.

The right model for this is:

A) A simple function call. It can return information related to it's success and throw an exception if it failed.

B) Return promises. Resolve them if login was successful, Reject them if not.

C) Use async/await. Again: return the result if it was successful, throw an error if not.

D) Use the callback pattern that you're already using with express. So pass a callback with a err and result parameter.

The last option might be preferable because you're working with a framework that doesn't support Promises and async/await well.