passport README

The project's README from github.com/jaredhanson/passport. As one markdown file: README.md.

passport banner

Passport

Passport is Express-compatible authentication middleware for Node.js.

Passport's sole purpose is to authenticate requests, which it does through an extensible set of plugins known as strategies. Passport does not mount routes or assume any particular database schema, which maximizes flexibility and allows application-level decisions to be made by the developer. The API is simple: you provide Passport a request to authenticate, and Passport provides hooks for controlling what occurs when authentication succeeds or fails.

Sponsors

Simple Authentication
Make login our problem. Not yours.

Auth0 by Okta provides a simple and customizable login page to authenticate your users. You can dynamically add new capabilities to it - including social login, multi-factor authentication, or passkeys - without making changes to your app’s code.

We help protect your app and your users from attacks - defending your application from bot attacks and detecting runtime anomalies based on suspicious IPs, breached credentials, user context, and more.


Your app, enterprise-ready.
Start selling to enterprise customers with just a few lines of code. Add Single Sign-On (and more) in minutes instead of months.


Drag and drop your auth
Add authentication and user management to your consumer and business apps with a few lines of code.


Auth. Built for Devs, by Devs
Add login, registration, SSO, MFA, and a bazillion other features to your app in minutes. Integrates with any codebase and installs on any server, anywhere in the world.


API-first AuthN, AuthZ, and Fraud Prevention
The most powerful identity platform built for developers. Easily build and secure a modern auth flow with user & org management, multi-tenant SSO, MFA, RBAC, device fingerprinting, and more.

Status: Build Coverage Dependencies

Install

$ npm install passport

Usage

Strategies

Passport uses the concept of strategies to authenticate requests. Strategies can range from verifying username and password credentials, delegated authentication using OAuth (for example, via Facebook or Twitter), or federated authentication using OpenID.

Before authenticating requests, the strategy (or strategies) used by an application must be configured.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.verifyPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

There are 480+ strategies. Find the ones you want at: passportjs.org

Sessions

Passport will maintain persistent login sessions. In order for persistent sessions to work, the authenticated user must be serialized to the session, and deserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored. Instead, you provide functions to Passport which implements the necessary serialization and deserialization logic. In a typical application, this will be as simple as serializing the user ID, and finding the user by ID when deserializing.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Middleware

To use Passport in an Express or Connect-based application, configure it with the required passport.initialize() middleware. If your application uses persistent login sessions (recommended, but not required), passport.session() middleware must also be used.

var app = express();
app.use(require('serve-static')(__dirname + '/../../public'));
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

Authenticate Requests

Passport provides an authenticate() function, which is used as route middleware to authenticate requests.

app.post('/login', 
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

Strategies

Passport has a comprehensive set of over 480 authentication strategies covering social networking, enterprise integration, API services, and more.

Search all strategies

There is a Strategy Search at passportjs.org

The following table lists commonly used strategies:

Strategy Protocol Developer
Local HTML form Jared Hanson
OpenID OpenID Jared Hanson
BrowserID BrowserID Jared Hanson
Facebook OAuth 2.0 Jared Hanson
Google OpenID Jared Hanson
Google OAuth / OAuth 2.0 Jared Hanson
Twitter OAuth Jared Hanson
Azure Active Directory OAuth 2.0 / OpenID / SAML Azure

Examples

The modules page on the wiki lists other useful modules that build upon or integrate with Passport.

License

The MIT License

Copyright (c) 2011-2021 Jared Hanson <https://www.jaredhanson.me/>

passport (jaredhanson/passport)

Searching Database…

23.5K ·GitHub
Passport
What is this?Passport is Express-compatible authentication middleware for Node.js. Its sole purpose is authenticating requests, which it does through an extensible set of plugins called strategies.
Is this a hosted login service, or something I wire into my own app?It is middleware you wire into an Express or Connect-based Node.js app. It mounts no routes and assumes no database schema — routing, storage and app-level decisions stay with you.
How do I add it to my app?Install it with npm, then add the required passport.initialize() middleware to your Express or Connect app. Use authenticate() as route middleware, plus passport.session() for persistent login sessions.
Does it only work with Express, or any Node.js setup?It targets Express- or Connect-based apps and runs on Node 0.4.0 and newer. The core is deliberately small — three dependencies — because each login method ships as its own strategy package.
So it doesn't check logins itself — how does authentication actually happen?Through strategies: pluggable modules that each handle one method, from username-and-password forms to OAuth logins via Facebook or Twitter and OpenID federation. You configure the ones your app needs.
Is this server-side, or does any of it run in the browser?It runs server-side in your Node.js process next to Express or Connect. Nothing is injected into the browser — authentication happens over your app's own routes.
Can I use it in commercial projects?Yes — Passport is MIT licensed, so it is free to use, modify and ship in commercial software.
Do I have to change my database or user model to use it?No. Passport places no restrictions on how user records are stored — you provide the serialize and deserialize functions for sessions, typically serializing just the user ID and loading the user by it on later requests.
Which login providers and protocols are supported?Over 480 strategies, searchable at passportjs.org. Commonly used ones include Local (HTML form login), Facebook and Twitter via OAuth, Google via OpenID or OAuth 2.0, and Azure Active Directory via OAuth 2.0, OpenID or SAML.
What about the pieces around login, like protecting routes?The ecosystem covers them: connect-ensure-login adds middleware that ensures a login session, OAuth2orize is a toolkit for building OAuth 2.0 authorization servers, and OAuthorize for OAuth service providers.
Is there a complete working example to start from?Yes — the repo includes a full example built on passport-local, and the README links tutorials for local authentication with Mongo or Postgres and for social login, on Express 3.x and 4.x.
What are similar projects?hydra, django-allauth, logto, next-auth, helmet, zitadel, cas, LibreChat
Which topics is it in?openid-connect, local, saml, middleware, express, hooks, oauth2, node, oauth, authentication, backend, security
Creator
jaredhanson
Size
0.8 MB
Stars
23.5K
Updated
CommitAug 16
Age
15y
Commits · 90 Days