PassportJS middleware being called multiple times - node.js

Question

It seems whenever I call Passport's ensureAuthenticated middleware, it causes the passport.deserializeUser function to be called upwards 6-7 additional times. I'm not sure if it's my app's structure via Express, Sequelize, or the way Passport is being imported. For this reason, I'm going to lay out a few files in hopes of finding where its gone astray.
Here is how I have everything structured
application/
auth/
models/
node-modules/
public/
routes/
views/
app.js
My assumption is it's either because the middleware is not a singleton, and/or it's because my routing is set-up oddly. Note: I followed this guide on setting up a singleton sequelize approach.
./app.js
// .. imports
app.set('models', require('./models')); // singleton ORM (my assumption)
// .. session stuff
app.use(passport.initialize());
app.use(passport.session());
app.use(require('./auth'));
// .. etc
app.use('/', require('./routes')); // routing style possible issue?
// .. create server
./auth/index.js
module.exports = function () {
var express = require('express')
, passport = require('passport')
, Local = require('passport-local').Strategy
, app = express();
passport.use(new Local(
function(username, password, done) {
app.get('models').User.find({
where: {
username: username,
password: password
}
}).done(function (err, user) {
if (err) {
return done(err);
}
if (!user) {
return done(null, false, { message: 'Invalid login' });
}
return done(null, user);
});
}
));
passport.serializeUser(function(user, done) {
done(null, user.id);
});
passport.deserializeUser(function(id, done) {
app.get('models').User.find(id).done(function(err, user) {
done(err, user);
});
});
return app;
}();
./auth/middleware.js
exports.check = function(req, res, next) {
if (req.isAuthenticated()) {
return next();
}
res.redirect('/login')
};
exports.is = function(role) {
return function (req, res, next) {
if (req.usertypes[req.user.type] === role) next();
else res.redirect('back');
}
};
./routes/index.js
module.exports = function () {
var express = require('express')
, app = express();
app.get('/', function (req, res) {
if (!req.user) res.redirect('/login');
else res.redirect('/' + req.usertypes[req.user.type]);
});
app.use('/admin', require('./admin'));
app.use('/another1', require('./another1')); // yadda
app.use('/another2', require('./another2')); // yadda
app.use('/login', require('./login'));
app.get('/logout', function(req, res){
req.logout();
res.redirect('/');
});
return app;
}();
and Finally, ./routes/admin.js
module.exports = function () {
var express = require('express')
, auth = require('../auth/middleware')
, admin = express();
// auth.check seems to be what's firing the multiple queries:
// Executing: SELECT * FROM `users` WHERE `users`.`id`=1 LIMIT 1;
// 6 times from the looks of it.
admin.get('/', auth.check, auth.is('admin'), function (req, res) {
res.render('admin', {
username: 'req.user.username'
});
});
admin.get('/users.json', auth.check, auth.is('admin'), function (req, res) {
res.contentType('application/json');
admin.get('models').User.findAll().done(function (err, users) {
if (users.length === 0) {
// handle
} else {
res.send(JSON.stringify(users));
}
});
});
admin.post('/adduser', auth.check, auth.is('admin'), function (req, res) {
var post = req.body;
admin.get('models').User.create(post).done(function (err, user) {
if (!err) {
res.send(JSON.stringify({success: true, users: user}));
} else {
res.send(JSON.stringify({success: false, message: err}));
}
});
});
return admin;
}();
I know it's a bit of code, but I have a feeling it's something very very simple. Any guidance would be much appreciated.

Answer 1

It's because you are using your passportJS session middleware earlier than your static files. Because of that your all static file calls (like <img src="...">) passing thru session middleware and calling deserializeUser().
Solution
Use your session middleware after app.use(express.static(...)) in your app.js file.
Check jaredhandson's this GitHub issue answer for more details : https://github.com/jaredhanson/passport/issues/14#issuecomment-4863459

Answer 2

I just had that problem. The reason all your static assets are running through your middleware is because you are either not defining what are static assets or you're defining it too late. I had to tell it to use /assets as the base for the public files, and then you have to make sure it comes before your other app.use definitions.
app.use('/assets', express.static(path.join(__dirname, 'public')));