Passport

To maintain persistent login sessions, you must implement serialization and deserialization logic. This allows Passport to store a minimal identifier (like a user ID) in the session and retrieve the full user object on subsequent requests.

• passport.serializeUser: Defines how to store the user in the session.
• passport.deserializeUser: Defines how to retrieve the user from the session using the stored identifier.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Passport uses strategies to authenticate requests. A strategy is a plugin that handles a specific authentication method, such as username/password (Local), OAuth (Facebook, Twitter), or OpenID.

Before you can use a strategy, you must configure it using passport.use(). The strategy provides a callback function that receives credentials and a done function to signal success or failure to Passport.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.verifyPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

To use Passport in an Express or Connect-based application, you must include the passport.initialize() middleware. If you are using persistent sessions, you must also include passport.session() middleware.

Note: passport.session() requires a session middleware (like express-session) to be configured before it.

var app = express();
app.use(require('serve-static')(__dirname + '/../../public'));
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

To add Passport to your Node.js project, install it using npm:

$ npm install passport

When using sessions with Passport, you must define how a user object is serialized into a session and how it is deserialized back from a session (typically via a database lookup using an ID).

• passport.serializeUser(function(user, done) { ... }): Determines which data from the user object should be stored in the session (e.g., the user ID).
• passport.deserializeUser(function(id, done) { ... }): Uses the stored data (e.g., the ID) to look up the full user object on subsequent requests.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Passport operates in two modes depending on whether your application is stateless or session-based:

1. Stateless Applications: If you are not using sessions, passport.initialize() is sufficient to attach authentication methods to the request, but it will not persist login state between requests.
2. Session-based Applications: To persist login state, you must follow a specific middleware chain:
   • Session middleware (e.g., express-session or connect.session())
   • passport.initialize()
   • passport.session()

In session-based mode, passport.serializeUser and passport.deserializeUser are required to bridge the gap between the session store and your user database.

Use passport.authenticate() as route middleware to trigger the authentication process for a specific strategy. You can pass options like failureRedirect to specify where to send the user if authentication fails.

app.post('/login', 
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

The passport module exports a pre-instantiated singleton instance of the Passport authenticator. For most standard use cases, you should require the module and use this exported instance directly to configure strategies and middleware.

const passport = require('passport');

// Use the singleton instance directly
passport.use(new MyStrategy());