I'm using passport.js local-strategy for auth. I also need users to authenticate with Facebook, Twitter, and G+, but not as auth alternatives, but to enable the user to retrieve their content from those services.

As written, each auth strategy writes a user object to the request object. This has the effect of logging-out my root user. Is there a way to leverage passport for these additional auth strategies, but not override the user object?

Here is the canonical example:

var passport = require('passport')
  , TwitterStrategy = require('passport-twitter').Strategy;

passport.use(new TwitterStrategy({
    consumerKey: TWITTER_CONSUMER_KEY,
    consumerSecret: TWITTER_CONSUMER_SECRET,
    callbackURL: ""
  },
  function(token, tokenSecret, profile, done) {
    User.findOrCreate(..., function(err, user) {
      if (err) { return done(err); }
      done(null, user); //trashes my existing user object
    });
  }
));

I'm using passport.js local-strategy for auth. I also need users to authenticate with Facebook, Twitter, and G+, but not as auth alternatives, but to enable the user to retrieve their content from those services.

As written, each auth strategy writes a user object to the request object. This has the effect of logging-out my root user. Is there a way to leverage passport for these additional auth strategies, but not override the user object?

Here is the canonical example:

var passport = require('passport')
  , TwitterStrategy = require('passport-twitter').Strategy;

passport.use(new TwitterStrategy({
    consumerKey: TWITTER_CONSUMER_KEY,
    consumerSecret: TWITTER_CONSUMER_SECRET,
    callbackURL: "http://www.example./auth/twitter/callback"
  },
  function(token, tokenSecret, profile, done) {
    User.findOrCreate(..., function(err, user) {
      if (err) { return done(err); }
      done(null, user); //trashes my existing user object
    });
  }
));

• javascript
• node.js
• passport.js

3 Answers 3

A way to do this is to use a callback rather than a redirect. Usually you would call req.login() to set the request object. You can just skip that step and do whatever you want with the response.

app.get('/auth/twitter/callback', function (req, res, next) {
        passport.authenticate('twitter', function (err, user, info) {
            res.send({err: err, user: user, info: info}); //skip req.login()
        })(req, res, next)
    });

This is listed in the Passport docs. http://passportjs/guide/authorize/

For anyone ing to this and the accepted solution does not work, I used Passport's authorize and set express-session's cookie's sameSite property set to 'lax'.

...
  app.use(
    expressSession({
      cookie: {
        sameSite: 'lax',
        httpOnly: true,
        maxAge: 7 * 24 * 60 * 60 * 1000
      },
...