Express + Passport + Session. Executes a query for every page load - node.js

Question

I'm using Express 4.2.0 with passport 0.2.0.
The express-session middleware that I am using is 1.2.1
I'm relatively new to node authentication so please bear with me.
I noticed that for everyone page load, passport is executing a db request:
Executing (default): SELECT * FROM "users" WHERE "users"."user_id"=7 LIMIT 1;
This doesn't make sense to me as I would think that the user has already been authenticated and serialized. And the session is now stored in the browser cookie. I also checked that I do have a cookie session stored in my browser.
Here are my app.js configuration:
var express = require('express');
var path = require('path');
var favicon = require('static-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');
//var sys = require('sys');
var cons = require('consolidate');
/* sequelize */
var db = require('./models');
/* passport and its friends */
var passport = require('passport');
var flash = require('connect-flash');
var session = require('express-session');
/* routes */
var routes = require('./routes/index');
var users = require('./routes/users');
//filesystem middleware
//var fs = require('fs');
var app = express();
// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.engine('dust', cons.dust);
app.set('view engine', 'dust');
app.use(favicon());
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded());
app.use(cookieParser('hashionhashion'));
app.use(require('less-middleware')(path.join(__dirname, 'public')));
app.use(express.static(path.join(__dirname, 'public')));
app.use(session({ secret: 'hashionhashion' })); // session secret
app.use(passport.initialize());
app.use(passport.session()); // persistent login sessions
app.use(flash()); // use connect-flash for flash messages stored in session
//routing
app.use('/', routes);
app.use('/users', users);
and here is the passport serialize/deserialize function:
passport.serializeUser(function(user, done) {
done(null, user.user_id);
});
// used to deserialize the user
passport.deserializeUser(function(id, done) {
db.User.find({ where: {user_id: id} }).success(function(user){
done(null, user);
}).error(function(err){
done(err, null);
});
});

Answer 1

Executing a query on each request to fetch the authenticated user data sometimes is not a good practice(but it is commonly used in apps).
In one of my apps, i only needed id of the authenticated user rather than all data (like password,last_login_date,register_date, ...) so i changed passport configs like below:
passport.serializeUser(function(user, done) {
done(null, {id: user.id});
});
// used to deserialize the user
passport.deserializeUser(function(object, done) {
done(null, object); // object is: {id: user_id}
});
and then in your controllers you can get user id from session:
router.get('/', function(req, res, next)=> {
const userId = req.user.id;
// now do a database query only if needed :)
});
you can also define a custom middleware to fetch user from db and set to
req.user to use in next middleware:
function fetchUser (req, res, next) {
db.User.find({ where: {id:req.user.id} }).success(function(user){
req.user = user;
next(); // will trigger next middleware
}).error(function(err){
next(err); // will trigger error handler
});
}
router.get('/', fetchUser, function(req, res, next)=> {
const user = req.user;
// now user is a object that is fetched from db and has all properties
});
In this approach you'll execute query for retrieving user from db only if it's needed and not for all routes.