sequelize find on login retrives always sucess

I am trying to do a simple login using nodejs and sequelize, i already have a user on the database and i try to send the info as req.body and checking if it exist in the where clausure

Like this:

router.post('/', function (req, res, next) {
  console.log("hi");
  if (JSON.stringify(req.body) == "{}") {
    return res.status(400).json({ Error: "Login request body is empty" });
  }
  if (!req.body.username || !req.body.password) {
    return res.status(400).json({ Error: "Missing fields for login" });
  }
  User.find({ where: { username: req.body.username,password: req.body.password} })
    .then(function (user) {
      return res.status(200).json({ message: "loged in!" });
    }).catch(function (err) {
      return res.status(400).json({ Error: "There is no user with those fields" });
    });
});

it enters always on the loged in message, even if i send data that doesn't exist on the database, any info why it is happening?

via Antonio Costa