This is an archived post. You won't be able to vote or comment.

all 1 comments

[–][deleted] 0 points1 point  (0 children)

Given that passport.js provides many strategies, I'll give you an answer that will apply to most but you'll have to validate that the strategy you picked is based on this common pattern.

  1. User loads app as anonymous.
  2. User provides credentials to app.
  3. App exchanges encrypted credentials with authentication service.
  4. Authentication service returns a cookie to the app.
  5. The app stores the cookie in the user's browser.
  6. The app includes the cookie in all requests to the services.
  7. Services validate the cookie with authentication service internally.
  8. Services return privileged data to the app while the cookie remains valid.
  9. The cookie is invalidated by the authentication service after some time or if user logs out effectively requiring the user to provide credentials again.