@passport-next/passport

Passport-Next/Passport

Passport-Next/Passport is Express-compatible authentication middleware for Node.js.

Passport's sole purpose is to authenticate requests, which it does through an extensible set of plugins known as strategies. Passport does not mount routes or assume any particular database schema, which maximizes flexibility and allows application-level decisions to be made by the developer. The API is simple: you provide Passport a request to authenticate, and Passport provides hooks for controlling what occurs when authentication succeeds or fails.

Status:

Differences between passport and passport-next

Passport Next was created as a fork of the Passport repositories when the upstream repositories became stale and stopped working due to changes at the various authentication providers (e.g. Facebook API deprecation, Tumblr using HTTPS etc.)

Passport Next aims to:

• Keep the modules up to date with the various authentication providers
• Maintain up to date dependencies
• Address any security issues promptly
• Ensure compatibility with the current supported versions of Node
• Maintain the repositories in an organisation so maintaining isn't the responsibility of one person
• Follow Semantic Versioning
• Keep an up to date CHANGELOG.md

Passport Next does not aim to be backwards compatible with the upstream repositories. The changes required to keep up to date and functioning prohibit that so if you're migrating from the upstream modules please test your code thouroughly!

If you wish to join the team please raise an issue and one of the maintainers will assess your request.

Install

$ npm install @passport-next/passport

Usage

Strategies

Passport uses the concept of strategies to authenticate requests. Strategies can range from verifying username and password credentials, delegated authentication using OAuth (for example, via Facebook or Twitter), or federated authentication using OpenID.

Before authenticating requests, the strategy (or strategies) used by an application must be configured.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.verifyPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

There are 480+ strategies. Find the ones you want at: passportjs.org

Sessions

Passport will maintain persistent login sessions. In order for persistent sessions to work, the authenticated user must be serialized to the session, and deserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored. Instead, you provide functions to Passport which implements the necessary serialization and deserialization logic. In a typical application, this will be as simple as serializing the user ID, and finding the user by ID when deserializing.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Middleware

To use Passport in an Express or Connect-based application, configure it with the required passport.initialize() middleware. If your application uses persistent login sessions (recommended, but not required), passport.session() middleware must also be used.

var app = express();
app.use(require('serve-static')(__dirname + '/../../public'));
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

Authenticate Requests

Passport provides an authenticate() function, which is used as route middleware to authenticate requests.

app.post('/login', 
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

Protect Routes When Using Sessions

Passport provides an isAuthenticated() function on the request object, which is used to determine if the user has been authenticated and stored in the session.

app.post('/some/protected/route', 
  function(req, res, next) {
    if(req.isAuthenticated()){
      next();
    } else {
      next(new Error('Unauthorized'));
    }
  });

For a more complete solution to handling unauthenticated users, see connect-ensure-login, a middleware to ensure login sessions.

Strategies

Passport has a comprehensive set of over 480 authentication strategies covering social networking, enterprise integration, API services, and more.

Search all strategies

There is a Strategy Search at passportjs.org

The following table lists commonly used strategies:

Strategy	Protocol	Developer
Local	HTML form	Jared Hanson
OpenID	OpenID	Jared Hanson
BrowserID	BrowserID	Jared Hanson
Facebook	OAuth 2.0	Jared Hanson
Google	OpenID	Jared Hanson
Google	OAuth / OAuth 2.0	Jared Hanson
Twitter	OAuth	Jared Hanson
Azure Active Directory	OAuth 2.0 / OpenID / SAML	Azure

Examples

• For a complete, working example, refer to the example that uses passport-local.
• Local Strategy: Refer to the following tutorials for setting up user authentication via LocalStrategy (passport-local):
  • Mongo
    • Express v3x - Tutorial / working example
    • Express v4x - Tutorial / working example
  • Postgres
    • Tutorial / working example
    • Koa - Tutorial / working example
• Social Authentication: Refer to the following tutorials for setting up various social authentication strategies:
  • Express v3x - Tutorial / working example
  • Express v4x - Tutorial / working example

Tests

$ npm install
$ make test

Changelog

2.1.1 (2019-04-30)

Patch

• Added gitlab sast testing @rwky
• Updated npm dev deps @rwky
• Updated README and CONTRIBUTING to explain differences between passport and passport-next #13 @rwky
• Fixed monkey patch and memory leak #15 #9 @MayaWolf