Simple, unobtrusive authentication for Node.js
npx @tessl/cli install tessl/npm-passport@0.7.0Passport is a comprehensive Express-compatible authentication middleware for Node.js that provides a complete authentication framework through an ecosystem of 480+ strategies. It serves as a lightweight, unobtrusive authentication layer that handles request authentication without imposing database schema constraints or mounting routes, giving developers maximum flexibility in application architecture.
npm install passportconst passport = require("passport");For ES modules:
import passport from "passport";Access to constructors and strategies:
const { Passport, Strategy } = require("passport");
// or
import { Passport, Strategy } from "passport";const express = require("express");
const session = require("express-session");
const passport = require("passport");
const LocalStrategy = require("passport-local").Strategy;
const app = express();
// Configure express-session middleware
app.use(session({
secret: "keyboard cat",
resave: false,
saveUninitialized: false
}));
// Initialize Passport
app.use(passport.initialize());
app.use(passport.session());
// Configure user serialization
passport.serializeUser((user, done) => {
done(null, user.id);
});
passport.deserializeUser((id, done) => {
// Load user from database
User.findById(id, (err, user) => {
done(err, user);
});
});
// Register authentication strategy
passport.use(new LocalStrategy(
(username, password, done) => {
// Verify credentials
User.findOne({ username }, (err, user) => {
if (err) return done(err);
if (!user || !user.validatePassword(password)) {
return done(null, false, { message: "Invalid credentials" });
}
return done(null, user);
});
}
));
// Protected route
app.post("/login",
passport.authenticate("local", {
successRedirect: "/dashboard",
failureRedirect: "/login"
})
);Passport is built around several key components:
Main authentication functionality including strategy management, middleware creation, and request processing. This is the primary interface for integrating Passport into applications.
// Default singleton instance
const passport = require("passport");
// Strategy management
passport.use(name, strategy);
passport.use(strategy);
passport.unuse(name);
// Middleware generation
passport.initialize(options);
passport.authenticate(strategy, options, callback);
passport.authorize(strategy, options, callback);
passport.session(options);User session handling including login/logout operations and user serialization/deserialization for persistent authentication state across requests.
// User serialization/deserialization
passport.serializeUser(fn);
passport.deserializeUser(fn);
// Request methods (added by Passport)
req.logIn(user, options, callback);
req.logOut(options, callback);
req.isAuthenticated();
req.isUnauthenticated();Framework for creating custom authentication strategies and understanding the strategy interface for advanced authentication scenarios.
const Strategy = require("passport-strategy");
class CustomStrategy extends Strategy {
constructor(options, verify) {
super();
this.name = "custom";
// Strategy implementation
}
authenticate(req, options) {
// Authentication logic
this.success(user, info);
this.fail(challenge, status);
this.redirect(url, status);
this.pass();
this.error(err);
}
}interface AuthenticateOptions {
session?: boolean;
keepSessionInfo?: boolean;
successRedirect?: string;
failureRedirect?: string;
successFlash?: boolean | string | { type: string; message: string };
failureFlash?: boolean | string | { type: string; message: string };
successMessage?: boolean | string;
failureMessage?: boolean | string;
failWithError?: boolean;
assignProperty?: string;
authInfo?: boolean;
successReturnToOrRedirect?: string;
}
interface InitializeOptions {
userProperty?: string;
compat?: boolean;
}
interface SerializationCallback {
(err: Error | null, user?: any): void;
}
interface DeserializationCallback {
(err: Error | null, user?: any): void;
}
interface VerifyCallback {
(err: Error | null, user?: any, info?: any): void;
}
class AuthenticationError extends Error {
constructor(message: string, status?: number);
name: "AuthenticationError";
message: string;
status: number;
}
interface SessionManagerOptions {
key?: string;
keepSessionInfo?: boolean;
}
interface LogInOptions {
session?: boolean;
keepSessionInfo?: boolean;
}
interface LogOutOptions {
keepSessionInfo?: boolean;
}
interface TransformAuthInfoCallback {
// Synchronous (arity 1)
(info: any): any;
// Asynchronous (arity 2)
(info: any, done: (err: Error | null, transformedInfo?: any) => void): void;
// With request access (arity 3)
(req: any, info: any, done: (err: Error | null, transformedInfo?: any) => void): void;
}
interface FrameworkAdapter {
initialize(passport: any, options?: any): Function;
authenticate(passport: any, name?: string | string[], options?: any, callback?: Function): Function;
}
// External dependencies (not part of Passport core)
interface UtilsMerge {
(dest: any, src: any): any;
}
interface PauseStream {
(stream: any): any;
}
interface PassportStrategy {
name: string;
authenticate(req: any, options?: any): void;
}