Repository files navigation

Passport isExpress-compatible authenticationmiddleware forNode.js.

Passport's sole purpose is to authenticate requests, which it does through anextensible set of plugins known asstrategies. Passport does not mountroutes or assume any particular database schema, which maximizes flexibility andallows application-level decisions to be made by the developer. The API issimple: you provide Passport a request to authenticate, and Passport provideshooks for controlling what occurs when authentication succeeds or fails.

^Sponsors

Simple Authentication
Make login our problem. Not yours.

Auth0 by Okta provides a simple and customizable login page to authenticate your users. You can dynamically add new capabilities to it - including social login, multi-factor authentication, or passkeys - without making changes to your app’s code.

We help protect your app and your users from attacks - defending your application from bot attacks and detecting runtime anomalies based on suspicious IPs, breached credentials, user context, and more.

Your app, enterprise-ready.
Start selling to enterprise customers with just a few lines of code. Add Single Sign-On (and more) in minutes instead of months.

Drag and drop your auth
Add authentication and user management to your consumer and business apps with a few lines of code.

Auth. Built for Devs, by Devs
Add login, registration, SSO, MFA, and a bazillion other features to your app in minutes. Integrates with any codebase and installs on any server, anywhere in the world.

API-first AuthN, AuthZ, and Fraud Prevention
The most powerful identity platform built for developers. Easily build and secure a modern auth flow with user & org management, multi-tenant SSO, MFA, RBAC, device fingerprinting, and more.

Status:

$ npm install passport

Passport uses the concept of strategies to authenticate requests. Strategiescan range from verifying username and password credentials, delegatedauthentication usingOAuth (for example, viaFacebookorTwitter), or federated authentication usingOpenID.

Before authenticating requests, the strategy (or strategies) used by anapplication must be configured.

passport.use(newLocalStrategy(function(username,password,done){User.findOne({username:username},function(err,user){if(err){returndone(err);}if(!user){returndone(null,false);}if(!user.verifyPassword(password)){returndone(null,false);}returndone(null,user);});}));

There are 480+ strategies. Find the ones you want at:passportjs.org

Passport will maintain persistent login sessions. In order for persistentsessions to work, the authenticated user must be serialized to the session, anddeserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored.Instead, you provide functions to Passport which implements the necessaryserialization and deserialization logic. In a typical application, this will beas simple as serializing the user ID, and finding the user by ID whendeserializing.

passport.serializeUser(function(user,done){done(null,user.id);});passport.deserializeUser(function(id,done){User.findById(id,function(err,user){done(err,user);});});

To use Passport in anExpress orConnect-based application, configure itwith the requiredpassport.initialize() middleware. If your application usespersistent login sessions (recommended, but not required),passport.session()middleware must also be used.

varapp=express();app.use(require('serve-static')(__dirname+'/../../public'));app.use(require('cookie-parser')());app.use(require('body-parser').urlencoded({extended:true}));app.use(require('express-session')({secret:'keyboard cat',resave:true,saveUninitialized:true}));app.use(passport.initialize());app.use(passport.session());

Passport provides anauthenticate() function, which is used as routemiddleware to authenticate requests.

app.post('/login',passport.authenticate('local',{failureRedirect:'/login'}),function(req,res){res.redirect('/');});

Passport has a comprehensive set ofover 480 authentication strategiescovering social networking, enterprise integration, API services, and more.

There is aStrategy Search atpassportjs.org

The following table lists commonly used strategies:

• For a complete, working example, refer to theexamplethat usespassport-local.
• Local Strategy: Refer to the following tutorials for setting up user authentication via LocalStrategy (passport-local):
  • Mongo
    • Express v3x -Tutorial /working example
    • Express v4x -Tutorial /working example
  • Postgres
    • Tutorial /working example
• Social Authentication: Refer to the following tutorials for setting up various social authentication strategies:
  • Express v3x -Tutorial /working example
  • Express v4x -Tutorial /working example

• Locomotive — Powerful MVC web framework
• OAuthorize — OAuth service provider toolkit
• OAuth2orize — OAuth 2.0 authorization server toolkit
• connect-ensure-login — middleware to ensure login sessions

Themodules page on thewiki lists other useful modulesthat build upon or integrate with Passport.

The MIT License

Copyright (c) 2011-2021 Jared Hanson <https://www.jaredhanson.me/>