Passport.js authenticate() custom callback and failureFlash behavior

Direct Answer

Yes, providing a custom callback to passport.authenticate() completely overrides the built-in failureFlash and successFlash logic. The options object is still accepted, but the flash flags are ignored. There is no configuration flag to re-enable automatic flash messaging while keeping a custom callback.

Why This Happens

In Passport.js v0.6–0.7, the authentication middleware treats a custom callback as a full takeover of the response flow. When the middleware detects a function as the last argument, it executes the strategy and immediately invokes your callback with (err, user, info, status), then returns. The internal code path that reads failureFlash/successFlash and calls req.flash() is never reached.

Confirmed Behavior

• The info object passed to your callback contains the strategy's message (typically { message: 'Invalid credentials' }).
• Strategies like passport-local populate info.message on both failure and success.
• You must call req.flash() manually inside the callback.
• This behavior has been consistent since custom callbacks were introduced; Passport 0.7.x did not change it.

Standard Manual Flash Pattern

app.post('/login',
  passport.authenticate('local', { failureFlash: true }, (err, user, info) => {
    if (err) return next(err);
    if (!user) {
      // Manual flash using the strategy's message
      req.flash('error', info?.message);
      return res.redirect('/login');
    }
    req.logIn(user, (loginErr) => {
      if (loginErr) return next(loginErr);
      // Optional success flash
      req.flash('success', info?.message || 'Welcome back!');
      return res.redirect('/dashboard');
    });
  })
);

Prerequisites

Ensure connect-flash (or express-flash) middleware is mounted before passport.initialize():

app.use(require('connect-flash')());
app.use(passport.initialize());
app.use(passport.session());

One Diagnostic Detail

If you are seeing req.flash is not a function inside the callback, confirm that flash middleware is installed and ordered correctly. That is the only setup issue that changes the recommendation.