All 15 Authentication & Authorization questions
More in Authentication & Authorization
How should passwords be securely stored in a Node.js application's database, and why is bcrypt commonly used? What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is a JSON Web Token (JWT), and what are its three parts? What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token? How does the OAuth 2.0 Authorization Code flow work, and what role does Node.js typically play as the client or the resource server?
Advertisement
Node.js › Authentication & Authorization

What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods?

Intermediate

Answer

Passport.js is a widely used Express-compatible authentication middleware built around the concept of 'strategies' -- pluggable modules each implementing one specific authentication method (local username/password, Google OAuth, JWT, SAML, and hundreds of others) behind a consistent interface, so an application can support multiple authentication methods side by side, or switch between them, with minimal changes to route-handling code.
const passport = require('passport');
const LocalStrategy = require('passport-local').Strategy;

passport.use(new LocalStrategy(async (username, password, done) => {
  const user = await User.findOne({ username });
  if (!user || !(await user.comparePassword(password))) return done(null, false);
  return done(null, user);
}));

app.post('/login', passport.authenticate('local'), (req, res) => res.json({ success: true }));
Real-world example An application supporting both traditional username/password login and 'Sign in with GitHub' registers both a LocalStrategy and a GitHubStrategy with Passport, letting both authentication paths converge on the same req.user object and the same downstream authorization logic.

Common follow-ups: How does Passport's session serialization (serializeUser/deserializeUser) work to keep the session payload small?;What's a scenario where implementing authentication manually might be preferable to depending on Passport?

Authentication & Authorization (JWT OAuth Passport);Express & Middleware
All 15 Authentication & Authorization questions