Session issues with Passportjs - node.js

Question

I am trying to use passportjs in my nodejs app with express4. For testing purpose, I am using session-file-store to keep session.
The way I set up the session and passportjs :
this.app.use(session({
secret: process.env.SESSION_SECRET || configuration.session_secret,
store: new fileStore(),
resave: false,
saveUninitialized: false
}));
// config authentication
this.app.use(passport.initialize());
this.app.use(passport.session());
// Configure Passport
passport.use('local-login', new localStrategy.Strategy(
(username, password, done) => {
Services.users.authenticatePromise(username, password).then(
function(token) {
done(null, token);
},
function(err) {
done(null, false, err);
},
).done();
},
));
// Serialize user in session
passport.serializeUser((token: AccessToken, done) => {
let user = {
_token: token.accessToken,
_expiryInAt: token.expiryInMs + new Date().getTime(),
};
done(null, user);
});
passport.deserializeUser((sessionUser, done) => {
done(null, sessionUser);
});
However, the issue I am having is that if I don't write anything into the session before user is logged in, passportjs works fine. However if I am trying to write some data into session like shopping cart details, then passportjs would not be able to serialize the user token into the session store any more. so login cannot be successful.
What am I missing?

Answer 1

you have a couple of things wrong with your code that I can see.
first, serializeUser should take an object and return a string (typically a unique id or database key). Your function currently takes a string and returns an object; that's backwards.
second, deserializeUser should take a string and return a user object. Your function currently takes an object and returns that same object.
finally ,serializeUser and deserializeUser must be inverses of each other; meaning, passport can call deserializeUser(serializeUser(user)) and get back the original user object.
So you're going to want something like this:
passport.serializeUser((user, done) => {
return user.id;
});
passport.deserializeUser((id, done) => {
getUserFromDatabase({id: id}, function(err, user) {
if (err) {
done(err, null); // something went wrong; return error
} else if (!user) {
done(null, false); // no user found; return `false`
} else {
done(null, user); // return user
}
});
});
for more info see here: Understanding passport serialize deserialize