last day (20 days later) » 

11:47 PM
0
A: alternative to findById using passport in nodejs authentication?

ploerThe deserializeUser function takes the user identifier (which is stored in the session), and uses it to get your full user object from your user store, in order to populate the user member of your express request object. This is useful because you probably don't want to store your full user obje...

 
I don't have a behavior that I am seeing; it is one of my requirements. It is working for using the username as my identifier. The problem that I'm running into is that I don't have access to the store containing the users. There is no way for me to retrieve a user object based off of an identifier; I can only send it a username and a password and it will tell me if it is valid.
or am i supposed to retrieve my user object from my express session store? I am so confused.
 
I've updated the answer above to try to clarify that part, let me know if it helps. :-)
 
Thanks, that makes it clearer. However, how do I store additional info in the session? let's say I want to store a username, a token, and a hashed password, and then retrieve those three from the session every time I deserialize. Is that possible?
Because that is what my userobject should be; I'd like to retrieve that all from the session if possible with a deserialize.
 
If I'm understanding your need correctly, you would just have your deserialize function return a user object that looks like { username: username, token: token, passwordHash: passwordHash }. Then req.user.token would contain the token, etc. (note however, that deserialize would be the place where you look these values up from your external store and put them in the session, not a place where you retrieve anything from the session as you mentioned)
 
well, where would i get the username, token, and passwordHash from? how do i serialize all 3 of those in the serialize function? in the deserialize, you mention that it is the place where I would look these values from external store, but I do not have an external store. Do I need to implement one? would redis work for that? Can't I proceed without implementing an external store, and instead just retrieving the user object from the session itself? Thanks!
 
11:47 PM
I guess I am missing something here. In your original statement you mentioned that you had an external server which is where you would check your passwords. If that is literally all it can do for you, and you aren't tracking users any other way, than your user object should probably just be {username: username}. In this scenario you shouldn't have to deal with a token or passwordHash on the user object -- your authenticate function will get a username and password, and be responsible for validating it or not. If validated, it will return '{ username: username }' as the user object.
I just tried to update the answer again to see if it addressed your concern... but maybe it would be more helpful to just chat :-)
 

  last day (20 days later) »