Application crash during deserializeUser when user record is missing

What to do when the user record is gone

When the database lookup in deserializeUser returns null or undefined, the callback must be invoked with a null user, not an error. Passport will then treat the request as unauthenticated and skip protected routes.

Recommended pattern

passport.deserializeUser(function(id, done) {
  User.findById(id, function(err, user) {
    if (err) return done(err);          // real DB error
    if (!user) return done(null, null); // user was deleted
    return done(null, user);
  });
});

Key points:

• Always check !user before accessing properties.
• Call done(null, null) for a missing record – this signals Passport that the session is no longer valid.
• Do not treat a missing user as a database error; only pass err for genuine failures.

Effect on the request lifecycle

After done(null, null) Passport sets req.user to undefined. Any middleware that expects a user should guard against that state, e.g.:

app.get('/profile', function(req, res, next) {
  if (!req.user) return res.status(401).send('Not authenticated');
  // safe to use req.user
});

Session invalidation

Passport itself does not automatically destroy the session when deserialization fails. The done(null, null) callback simply signals that the current session is not associated with a valid user. If you want to remove the session cookie immediately, call req.logout() or req.session.destroy() inside a custom middleware after deserialization.

When to ask for more info

If you see a stack trace that shows a property access on undefined inside your own code, double‑check that you are not dereferencing req.user without a guard. If the crash occurs before the deserializeUser callback returns, it likely means you omitted the null check.