passport (2024)

Passport is Express-compatible authenticationmiddleware for Node.js.

Passport's sole purpose is to authenticate requests, which it does through anextensible set of plugins known as strategies. Passport does not mountroutes or assume any particular database schema, which maximizes flexibility andallows application-level decisions to be made by the developer. The API issimple: you provide Passport a request to authenticate, and Passport provideshooks for controlling what occurs when authentication succeeds or fails.

Status:

Install

$ npm install passport

Usage

Strategies

Passport uses the concept of strategies to authenticate requests. Strategiescan range from verifying username and password credentials, delegatedauthentication using OAuth (for example, via Facebookor Twitter), or federated authentication using OpenID.

Before authenticating requests, the strategy (or strategies) used by anapplication must be configured.

passport.use(new LocalStrategy( function(username, password, done) { User.findOne({ username: username }, function (err, user) { if (err) { return done(err); } if (!user) { return done(null, false); } if (!user.verifyPassword(password)) { return done(null, false); } return done(null, user); }); }));

There are 480+ strategies. Find the ones you want at: passportjs.org

Sessions

Passport will maintain persistent login sessions. In order for persistentsessions to work, the authenticated user must be serialized to the session, anddeserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored.Instead, you provide functions to Passport which implements the necessaryserialization and deserialization logic. In a typical application, this will beas simple as serializing the user ID, and finding the user by ID whendeserializing.

passport.serializeUser(function(user, done) { done(null, user.id);});passport.deserializeUser(function(id, done) { User.findById(id, function (err, user) { done(err, user); });});

Middleware

To use Passport in an Express orConnect-based application, configure itwith the required passport.initialize() middleware. If your application usespersistent login sessions (recommended, but not required), passport.session()middleware must also be used.

var app = express();app.use(require('serve-static')(__dirname + '/../../public'));app.use(require('cookie-parser')());app.use(require('body-parser').urlencoded({ extended: true }));app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));app.use(passport.initialize());app.use(passport.session());

Authenticate Requests

Passport provides an authenticate() function, which is used as routemiddleware to authenticate requests.

app.post('/login', passport.authenticate('local', { failureRedirect: '/login' }), function(req, res) { res.redirect('/'); });

Strategies

Passport has a comprehensive set of over 480 authentication strategiescovering social networking, enterprise integration, API services, and more.

Search all strategies

There is a Strategy Search at passportjs.org

The following table lists commonly used strategies:

Examples

• For a complete, working example, refer to the examplethat uses passport-local.
• Local Strategy: Refer to the following tutorials for setting up user authentication via LocalStrategy (passport-local):
  • Mongo
    • Express v3x - Tutorial / working example
    • Express v4x - Tutorial / working example
  • Postgres
    • Tutorial / working example
• Social Authentication: Refer to the following tutorials for setting up various social authentication strategies:
  • Express v3x - Tutorial / working example
  • Express v4x - Tutorial / working example

Related Modules

• Locomotive — Powerful MVC web framework
• OAuthorize — OAuth service provider toolkit
• OAuth2orize — OAuth 2.0 authorization server toolkit
• connect-ensure-login — middleware to ensure login sessions

The modules page on thewiki lists other useful modulesthat build upon or integrate with Passport.

License

The MIT License

Copyright (c) 2011-2021 Jared Hanson <https://www.jaredhanson.me/>