ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #passport
Passport.js Session Store for Low-Traffic Workloads Passport.js defaults to an in-memory session store that provides no persistence across process restarts. For applications with minimal traffic, this may seem cost-effective since it avoids external dependencies. However, the lack of persistence can cause unexpected authentication failures during routine dep
Passport Session Handling The goal is to determine if Passport's session retrieval mechanism contributes to intermittent connection pool exhaustion when using an external store. Constraints and Uncertainty The exhaustion is likely external to Passport, residing in the configured session store (e.g., Redis or database). Does Passport exhibit any internal beha
Goal: Verify that Hibernate’s setFirstResult and setMaxResults produce identical offset‑based pagination across PostgreSQL, MySQL, Oracle, and SQL Server when the query includes a non‑unique ORDER BY clause. Uncertainty: Different Hibernate releases may translate the same API call into dialect‑specific SQL differently, and some versions switch to in‑memory p
When implementing custom retry logic for authentication in a Passport.js environment, the authenticate middleware is often re-invoked after an initial failure. While Passport typically writes user data to the session store only upon successful verification, the interaction between retry loops and session store idempotency is not explicitly defined in the cor
Goal Define a reliable strategy to keep existing sessions valid or safely invalidate them when the user model changes (fields added, removed, or renamed). Constraints Passport.js stores only what serializeUser returns; deserializeUser receives that opaque payload on every request. No core hook exists to attach a schema version, run a migration, or automatica
Migration goal I am planning to migrate a small application to a new Azure AD B2C User Flow without downtime. The documented approach of on-the-fly user import via the Microsoft Graph API, combined with a staged cutover using a new User Flow and gradual traffic redirection, looks workable in principle. Open concerns Two behaviors remain unclear to me before
The goal is to clarify whether the verify callback supplied to a Passport.js strategy must always receive three arguments (err, user, info) or may receive only two arguments (err, user) when the strategy does not generate an info object. Current Passport documentation leaves this behavior unspecified, and individual strategies such as passport-local and pass
When implementing pagination in a Java application using Hibernate ORM, the setFirstResult() and setMaxResults() methods are used to limit the result set and define the offset. This ensures the JVM heap is not overwhelmed by large datasets. However, there is a known architectural conflict when these methods are combined with HQL fetch join operations. If a q
I'm designing authentication for an Express app that will run behind a load balancer configured with sticky sessions (cookie-based affinity). Passport supports both approaches I'm weighing: the classic serializeUser / deserializeUser hooks backed by express-session , and the passport-jwt strategy with session: false so no server-side state is kept at all. My
hibernate
java