Implementing Session Authentication with Passport

Passport is a popular authentication middleware for Node.js applications. It provides a simple and easy-to-use API for implementing different authentication strategies, including local strategy, which is used for authenticating users with a username and password. In this blog, we will explore how to use Passport with local strategy to implement session authentication in a Node.js application.

Session authentication is a popular authentication mechanism in web applications, where the user’s session is stored on the server-side, and a unique session ID is sent to the client’s browser as a cookie. The session ID is used to authenticate the user in subsequent requests. Passport makes it easy to implement session authentication with local strategy.

To get started, we need to install the necessary dependencies. We will be using the following packages:

• passport: The core Passport library
• passport-local: The local strategy plugin for Passport
• express-session: A middleware for managing sessions in Express

1npm install passport passport-local express-session

Next, we will configure Passport to use the local strategy for authentication. In this example, we will be using a simple array of user objects to store user credentials. In a real-world application, you would use a database to store user information.

1const passport = require('passport');
2const LocalStrategy = require('passport-local').Strategy;
3 
4// User data store
5const users = [
6  { id: 1, username: 'john', password: 'password' },
7  { id: 2, username: 'jane', password: 'password' }
8];
9 
10// Local strategy configuration
11passport.use(new LocalStrategy(
12  (username, password, done) => {
13    // Find user with matching username
14    const user = users.find(u => u.username === username);
15    if (!user) {
16      return done(null, false, { message: 'Incorrect username' });
17    }
18 
19    // Check if password is correct
20    if (user.password !== password) {
21      return done(null, false, { message: 'Incorrect password' });
22    }
23 
24    // Authentication successful
25    return done(null, user);
26  }
27));
28 
29 

In the above code, we define a users array containing user objects with their usernames and passwords. We then configure the local strategy using passport.use(). The LocalStrategy constructor takes a callback function with the signature (username, password, done).

In the callback function, we search for the user with the given username in the users array. If a user is found, we check if the password is correct. If the authentication is successful, we call done(null, user) to indicate that the user is authenticated. If the authentication fails, we call done(null, false, { message: 'Incorrect username or password' }) to indicate that the authentication failed with an error message.

Next, we will configure the session middleware using express-session. This middleware creates a session object for each user and stores it on the server-side. We will be using an in-memory session store for simplicity.

1const session = require('express-session');
2const app = require('express')();
3 
4// Session middleware configuration
5app.use(session({
6  secret: 'my-secret-key',
7  resave: false,
8  saveUninitialized: false
9}));
10 
11// Passport middleware initialization
12app.use(passport.initialize());
13app.use(passport.session());
14 
15 

In the above code, we configure the session middleware using express-session. We pass a secret key to the middleware to encrypt the session data. We also set resave and saveUninitialized to false to optimize the session storage.

We then initialize the Passport middleware using passport.initialize() and passport.session(). The passport.initialize() middleware initializes Passport and the passport.session()

We then initialize the Passport middleware using passport.initialize() and passport.session(). The passport.initialize() middleware initializes Passport and the passport.session() middleware adds support for persistent login sessions.

We can now define the login and logout routes in our application. In the login route, we will use the passport.authenticate() middleware to authenticate the user with the local strategy.

1app.post('/login', passport.authenticate('local', {
2  successRedirect: '/',
3  failureRedirect: '/login',
4  failureFlash: true
5}));

In the above code, we define a POST route /login that authenticates the user using the passport.authenticate() middleware. We pass the local strategy as the first argument to passport.authenticate(). We also pass an options object that configures the middleware to redirect the user to the home page on successful authentication and to the login page on failed authentication. We also set failureFlash to true to enable flash messages.

In the logout route, we can simply call req.logout() to log out the user and destroy their session.

1app.get('/logout', (req, res) => {
2  req.logout();
3  res.redirect('/');
4});

We can now protect the routes that require authentication using the req.isAuthenticated() middleware. This middleware checks if the user is authenticated and calls the next middleware if they are, or redirects them to the login page if they are not.

1app.get('/', (req, res, next) => {
2  if (req.isAuthenticated()) {
3    return next();
4  }
5  res.redirect('/login');
6});
7 
8app.get('/profile', (req, res, next) => {
9  if (req.isAuthenticated()) {
10    res.render('profile');
11  } else {
12    res.redirect('/login');
13  }
14});

In the above code, we protect the / and /profile routes by checking if the user is authenticated using req.isAuthenticated(). If the user is authenticated, we call the next middleware to render the requested page. If the user is not authenticated, we redirect them to the login page.

We have now implemented session authentication using Passport with local strategy in our Node.js application. Passport provides a flexible and easy-to-use API for implementing different authentication strategies, making it a popular choice for authentication in Node.js applications.