How does Passport.js handle sessions?

Question

I am having trouble understanding the concept of sessions for a web application. I am running a Node.js server with Express 3.0.

Requirements:

• Create a session for each user that logs in

• Store this session and use it for validating if the user is already logged in (prevent two devices using the same user at the same time)

• Limit access to certain pages (by matching session ID to some other data)

Where does passport store sessions?

Answer 1

It stores user sessions (with express or connect) in req.user.

Keep in mind this is different from the express session middleware, which can store whatever you want in req.session.

To persist your user session with passport, use passport's middleware:

app.use(express.session({ secret: 'keyboard cat' }));
app.use(passport.initialize());

then access the user like so:

function someRoute(req, res, next) {
  // req.user = the user of this session
}