Passport.js for JavaScript (Node.js): Complete Guide with Examples

What is Passport.js and why is it needed?

Passport.js is the most popular and flexible library for authentication in Node.js applications. It is designed as a "middleware" layer for Express.js, which allows easy integration into any web server. The main task of Passport.js is to simplify the user authentication process by providing a unified interface for working with dozens of different authentication strategies.

Why is this library needed? In modern web development, authentication is not just about checking a username and password. Users expect the ability to log in via social networks (Google, Facebook, VK), corporate systems (LDAP, SAML), using JWT tokens, or one-time codes. Each of these methods requires its own logic, API requests, and error handling. Passport.js abstracts this complexity by offering a single pattern: you choose a "Strategy", configure it, and the library handles all the routine work of processing requests, sessions, and redirects.

Key advantages of Passport.js:

\n
• Modularity: over 500 strategies covering virtually all existing authentication methods.
\n
• Ease of integration: works as Express.js middleware, making the code clean and predictable.
\n
• Database independence: the library does not impose a way to store users — you decide how and where to store data (MongoDB, PostgreSQL, files).
\n
• Security: built-in session support, CSRF protection (via additional modules), and proper password handling.
\n
• Flexibility: you can combine strategies, create your own, and customize behavior for any business requirements.
\n

This article will be your comprehensive guide. We will start with installation, cover a quick start, study all the main methods and functions in detail, and then solidify the knowledge with a real practical example.

Installing the Library

Installing Passport.js and the necessary strategies is done via the npm package manager. The basic installation includes the library core and one of the strategies (most often passport-local for username/password authentication).

# Install Passport.js core\nnpm install passport\n\n# Install strategy for local authentication (username/password)\nnpm install passport-local\n\n# Install strategy for JWT (JSON Web Tokens)\nnpm install passport-jwt\n\n# Install strategy for OAuth 2.0 (Google, Facebook, etc.)\nnpm install passport-google-oauth20\n\n# Additional: for working with sessions (if not using JWT)\nnpm install express-session\n\n# For password hashing (recommended)\nnpm install bcryptjs

Note: passport is only the core. Specific authentication methods (via Google, Facebook, locally, etc.) are implemented through separate strategy packages. There are several hundred of them, and you can find the one you need on the official website passportjs.org/packages/.

Quick Start with Code Example

Let's create a minimal Express.js application with local authentication (username and password). This example will show the basic architecture of Passport.js.

Step 1: Create a file app.js and install dependencies.

const express = require('express');\nconst passport = require('passport');\nconst LocalStrategy = require('passport-local').Strategy;\nconst session = require('express-session');\nconst bcrypt = require('bcryptjs');\n\nconst app = express();\n\n// Configure middleware for parsing request body\napp.use(express.urlencoded({ extended: false }));\napp.use(express.json());\n\n// Configure sessions (required for passport with sessions)\napp.use(session({