ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Security & identity · #passport
Shows how to configure Passport.js with the Local strategy, keep session data minimal, define trust boundaries, and add operational checks for secure Node.js authentication.
A technical decision guide for choosing between Passport.js Local and OAuth 2.0 strategies, comparing security burdens, user friction, and implementation patterns.
Learn how to implement a decoupled authentication architecture using Passport.js Local Strategy, focusing on the separation of credential verification and session persistence.
Learn how to set up Passport‑JWT in Express for stateless authentication. The guide covers strategy configuration, token extraction, expiration handling, common pitfalls, and a practical checklist to ensure a secure, scalable API.
Learn what serializeUser and deserializeUser do, see a working local‑strategy example, and understand why you might keep them when switching to a stateless JWT approach.
Passport.js leaves the key architectural choice to you: server-side sessions with passport-local, or stateless tokens with passport-jwt. Compare the real trade-offs — revocation, scaling, CSRF, XSS — then implement and validate session auth concretely.
Session Termination Behavior Updating a Node.js application to Passport.js version 0.6.0 introduces a breaking change to the req.logout() method. In previous versions, this method operated synchronously, allowing developers to call it without a callback function before redirecting the user. Starting with version 0.6.0, req.logout() is asynchronous and requir
The objective is to verify whether user objects attached to req.user by a Passport.js strategy survive an Express-session restore, where the session store serializes the entire session payload. Because strategies may attach functions, class instances, Dates, Symbols, or other non‑JSON‑compatible values, and because session middleware uses JSON (or custom) se
Request Propagation in Passport.js Passport v0.5.0 formally documented the passReqToCallback option, allowing the request object to be passed as the first argument to the verify callback. While previously associated primarily with the strategy constructor, this functionality was extended to passport.authenticate to support more dynamic configurations. Config
nodejs
express