willcode2surf / passport

Simple, unobtrusive authentication for Node.js.

Passport

Passport is Express-compatible authentication middleware for Node.js.

Passport's sole purpose is to authenticate requests, which it does through an extensible set of plugins known as strategies. Passport does not mount routes or assume any particular database schema, which maximizes flexiblity and allows application-level decisions to be made by the developer. The API is simple: you provide Passport a request to authenticate, and Passport provides hooks for controlling what occurs when authentication succeeds or fails.

Install

$ npm install passport

Donate

Using Passport in your project? Donations are greatly appreciated and help support development of this and other quality modules.

Usage

Strategies

Passport uses the concept of strategies to authenticate requests. Strategies can range from verifying username and password credentials, delegated authentication using OAuth (for example, via Facebook or Twitter), or federated authentication using OpenID.

Before authenticating requests, the strategy (or strategies) used by an application must be configured.

passport.use(new LocalStrategy(
  function(username, password, done) {
    User.findOne({ username: username, password: password }, function (err, user) {
      done(err, user);
    });
  }
));

Sessions

Passport will maintain persistent login sessions. In order for persistent sessions to work, the authenticated user must be serialized to the session, and deserialized when subsequent requests are made.

Passport does not impose any restrictions on how your user records are stored. Instead, you provide functions to Passport which implements the necessary serialization and deserialization logic. In a typical application, this will be as simple as serializing the user ID, and finding the user by ID when deserializing.

passport.serializeUser(function(user, done) {
  done(null, user.id);
});

passport.deserializeUser(function(id, done) {
  User.findById(id, function (err, user) {
    done(err, user);
  });
});

Middleware

To use Passport in an Express or Connect-based application, configure it with the required passport.initialize() middleware. If your application uses persistent login sessions (recommended, but not required), passport.session() middleware must also be used.

app.configure(function() {
  app.use(express.static(__dirname + '/../../public'));
  app.use(express.cookieParser());
  app.use(express.bodyParser());
  app.use(express.session({ secret: 'keyboard cat' }));
  app.use(passport.initialize());
  app.use(passport.session());
  app.use(app.router);
});

Authenticate Requests

Passport provides an authenticate() function, which is used as route middleware to authenticate requests.

app.post('/login', 
  passport.authenticate('local', { failureRedirect: '/login' }),
  function(req, res) {
    res.redirect('/');
  });

Strategies

Passport has a comprehensive set of over 140 authentication strategies covering social networking, enterprise integration, API services, and more. The complete list is available on the wiki.

The following table lists commonly used strategies:

Strategy	Protocol	Developer
Local	HTML form	Jared Hanson
OpenID	OpenID	Jared Hanson
BrowserID	BrowserID	Jared Hanson
Facebook	OAuth 2.0	Jared Hanson
Google	OpenID	Jared Hanson
Google	OAuth / OAuth 2.0	Jared Hanson
Twitter	OAuth	Jared Hanson

Examples

• For a complete, working example, refer to the login example included in passport-local.
• Local Strategy: Refer to this tutorial on setting up user authentication via LocalStrategy (passport-local), including a working example found on this repo.
• Social Authentication: Refer to this tutorial for setting up various social authentication strategies, including a working example found on this repo.

Related Modules

• Locomotive — Powerful MVC web framework
• OAuthorize — OAuth service provider toolkit
• OAuth2orize — OAuth 2.0 authorization server toolkit
• connect-ensure-login — middleware to ensure login sessions

The modules page on the wiki lists other useful modules that build upon or integrate with Passport.

Tests

$ npm install --dev
$ make test

Credits

• Jared Hanson

License

The MIT License

Copyright (c) 2011-2013 Jared Hanson <http://jaredhanson.net/>