passport README

The project's README from github.com/jaredhanson/passport. As one markdown file: README.md.

passport banner

Passport

Passport is Express-compatible authentication middleware for Node.js.

Passport's sole purpose is to authenticate requests, which it does through an extensible set of plugins known as strategies. Passport does not mount routes or assume any particular database schema, which maximizes flexibility and allows application-level decisions to be made by the developer. The API is simple: you provide Passport a request to authenticate, and Passport provides hooks for controlling what occurs when authentication succeeds or fails.

Sponsors

Simple Authentication
Make login our problem. Not yours.

Auth0 by Okta provides a simple and customizable login page to authenticate your users. You can dynamically add new capabilities to it - including social login, multi-factor authentication, or passkeys - without making changes to your app’s code.

We help protect your app and your users from attacks - defending your application from bot attacks and detecting runtime anomalies based on suspicious IPs, breached credentials, user context, and more.


Your app, enterprise-ready.
Start selling to enterprise customers with just a few lines of code. Add Single Sign-On (and more) in minutes instead of months.


Drag and drop your auth
Add authentication and user management to your consumer and business apps with a few lines of code.


Auth. Built for Devs, by Devs
Add login, registration, SSO, MFA, and a bazillion other features to your app in minutes. Integrates with any codebase and installs on any server, anywhere in the world.


API-first AuthN, AuthZ, and Fraud Prevention
The most powerful identity platform built for developers. Easily build and secure a modern auth flow with user & org management, multi-tenant SSO, MFA, RBAC, device fingerprinting, and more.

Status: Build Coverage Dependencies

Install

$ npm install passport

Usage

Strategies

Passport uses the concept of strategies to authenticate requests. Strategies can range from verifying username and password credentials, delegated authentication using OAuth (for example, via Facebook or Twitter), or federated authentication using OpenID.

Before authenticating requests, the strategy (or strategies) used by an application must be configured.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username }, function (err, user) {
      if (err) { return done(err); }
      if (!user) { return done(null, false); }
      if (!user.verifyPassword(password)) { return done(null, false); }
      return done(null, user);
    });
  }
));

There are 480+ strategies. Find the ones you want at: passportjs.org

Sessions

Passport will maintain persistent login sessions. In order for persistent sessions to work, the authenticated user must be serialized to the session, and deserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored. Instead, you provide functions to Passport which implements the necessary serialization and deserialization logic. In a typical application, this will be as simple as serializing the user ID, and finding the user by ID when deserializing.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Middleware

To use Passport in an Express or Connect-based application, configure it with the required passport.initialize() middleware. If your application uses persistent login sessions (recommended, but not required), passport.session() middleware must also be used.

var app = express();
app.use(require('serve-static')(__dirname + '/../../public'));
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({ secret: 'keyboard cat', resave: true, saveUninitialized: true }));
app.use(passport.initialize());
app.use(passport.session());

Authenticate Requests

Passport provides an authenticate() function, which is used as route middleware to authenticate requests.

app.post('/login', 
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

Strategies

Passport has a comprehensive set of over 480 authentication strategies covering social networking, enterprise integration, API services, and more.

Search all strategies

There is a Strategy Search at passportjs.org

The following table lists commonly used strategies:

Strategy Protocol Developer
Local HTML form Jared Hanson
OpenID OpenID Jared Hanson
BrowserID BrowserID Jared Hanson
Facebook OAuth 2.0 Jared Hanson
Google OpenID Jared Hanson
Google OAuth / OAuth 2.0 Jared Hanson
Twitter OAuth Jared Hanson
Azure Active Directory OAuth 2.0 / OpenID / SAML Azure

Examples

The modules page on the wiki lists other useful modules that build upon or integrate with Passport.

License

The MIT License

Copyright (c) 2011-2021 Jared Hanson <https://www.jaredhanson.me/>

passport (jaredhanson/passport)

Searching Database…

23.5K ·GitHub
Passport
这是什么东西？Passport 是适用于 Node.js 的、与 Express 兼容的身份认证中间件。它唯一的用途就是验证请求，通过一组名为策略（strategy）的可扩展插件来实现。
它是托管的登录服务，还是需要我自己接入到应用里的东西？它是需要你自己接入基于 Express 或 Connect 的 Node.js 应用的中间件。它不挂载任何路由，也不假定任何数据库结构——路由、存储和应用层面的决策都由你自己掌控。
怎么把它加到我的应用里？先用 npm 安装，然后在你的 Express 或 Connect 应用中加入必需的 passport.initialize() 中间件。把 authenticate() 用作路由中间件，如果需要持久的登录会话，再加上 passport.session()。
它只能配合 Express 使用，还是任何 Node.js 环境都行？它面向基于 Express 或 Connect 的应用，支持 Node 0.4.0 及更高版本。核心刻意做得很小——只有三个依赖——因为每种登录方式都以独立的策略包发布。
所以它本身不校验登录——那认证到底是怎么完成的？靠策略（strategy）来完成：每个策略是一个可插拔的模块，负责一种登录方式，从用户名加密码的表单，到通过 Facebook 或 Twitter 的 OAuth 登录，再到 OpenID 联合认证。你只需配置应用所需的那些。
它是纯服务端的吗，还是有部分在浏览器里运行？它在服务端随你的 Node.js 进程运行，与 Express 或 Connect 并存。不会向浏览器注入任何东西——认证全部通过你应用自己的路由完成。
我可以在商业项目里使用它吗？可以——Passport 采用 MIT 许可证，可以免费在商业软件中使用、修改和分发。
使用它需要改动我的数据库或用户模型吗？不需要。Passport 对用户记录的存储方式没有任何限制——你只需为会话提供 serialize 和 deserialize 函数，通常只序列化用户 ID，后续请求再凭它加载用户。
支持哪些登录方式和协议？共有 480 多个策略，可在 passportjs.org 上搜索。常用的包括 Local（HTML 表单登录）、通过 OAuth 的 Facebook 和 Twitter、通过 OpenID 或 OAuth 2.0 的 Google，以及通过 OAuth 2.0、OpenID 或 SAML 的 Azure Active Directory。
登录之外的部分呢，比如保护路由？生态系统都有覆盖：connect-ensure-login 提供确保已登录会话的中间件，OAuth2orize 是构建 OAuth 2.0 授权服务器的工具包，OAuthorize 则用于 OAuth 服务提供方。
有没有完整的可运行示例可以参考？有——仓库里包含一个基于 passport-local 的完整示例，README 还链接了相关教程，涵盖 Express 3.x 和 4.x 上配合 Mongo 或 Postgres 的本地认证，以及社交登录。
What are similar projects?hydra, django-allauth, logto, next-auth, helmet, zitadel, cas, LibreChat
Which topics is it in?openid-connect, local, saml, middleware, express, hooks, oauth2, node, oauth, authentication, backend, security
Creator
jaredhanson
Size
0.8 MB
Stars
23.5K
Updated
CommitAug 16
Age
15y
Commits · 90 Days