Security & Quality

Passport.js Strategies

Configure Passport.js authentication middleware with 500+ strategies for Express and Node.js applications.

Claude Code Cursor Copilot

Overview

Passport.js is the most widely used authentication middleware for Node.js, with over 500 authentication strategies available as separate packages. It follows a modular architecture where each authentication method (local, OAuth, SAML, etc.) is implemented as a strategy plugin, keeping the core library lightweight and flexible.

The library integrates seamlessly with Express.js and provides a consistent API for authenticating requests. Strategies handle the specifics of each authentication method while Passport manages session serialization, request augmentation, and authentication flow control. Popular strategies include passport-local for username/password, passport-google-oauth20 for Google, and passport-jwt for token-based auth.

Passport supports both session-based and stateless authentication. For session-based auth, it provides serialize/deserialize hooks that control how user data is stored in and retrieved from sessions. For API authentication, JWT and Bearer token strategies enable stateless request validation without server-side session storage.

Who Is This For?

Add local username/password auth to an Express app
Implement Google OAuth2 login with Passport
Set up JWT-based API authentication
Combine multiple auth strategies in one application

Installation

Setup for Claude Code

npm install passport passport-local express-session

Configuration

// config/passport.ts
import passport from "passport"
import { Strategy as LocalStrategy } from "passport-local"

passport.use(new LocalStrategy(
  async (username, password, done) => {
    const user = await User.findOne({ username })
    if (!user || !await user.verifyPassword(password)) {
      return done(null, false, { message: "Invalid credentials" })
    }
    return done(null, user)
  }
))