.github/FUNDING.yml

@@ -1,2 +1,3 @@
+github: jaredhanson
 patreon: jaredhanson
 ko_fi: jaredhanson

CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.5.0] - 2021-09-23
+### Changed
+
+- `initialize()` middleware extends request with `login()`, `logIn()`,
+`logout()`, `logOut()`, `isAuthenticated()`, and `isUnauthenticated()`
+functions.
+
+### Removed
+
+- `login()`, `logIn()`, `logout()`, `logOut()`, `isAuthenticated()`, and
+`isUnauthenticated()` functions no longer added to `http.IncomingMessage.prototype`.
+
+### Fixed
+
+- `userProperty` option to `initialize()` middleware only affects the current
+request, rather than all requests processed via singleton Passport instance,
+eliminating a race condition in situations where `initialize()` middleware is
+used multiple times in an application with `userProperty` set to different
+values.

README.md

@@ -12,6 +12,20 @@ allows application-level decisions to be made by the developer.  The API is
 simple: you provide Passport a request to authenticate, and Passport provides
 hooks for controlling what occurs when authentication succeeds or fails.
 
+---
+
+<p align="center">
+  <sup>Sponsors</sup>
+  <br>
+  <a href="https://www.loginradius.com/?utm_source=sponsership&utm_medium=github&utm_campaign=jaredhanson"><img src="https://raw.githubusercontent.com/jaredhanson/passport/master/sponsors/loginradius.png"></a><br/>
+  <a href="https://accounts.loginradius.com/auth.aspx?action=register?utm_source=sponsership&utm_medium=github&utm_campaign=jaredhanson">LoginRadius</a> is built for the developer community to integrate robust Authentication and Single Sign-On in just a few lines of code.<br/><a href="https://accounts.loginradius.com/auth.aspx?action=register?utm_source=sponsership&utm_medium=github&utm_campaign=jaredhanson">FREE Signup</a>
+  <br><br>
+  <a href="https://workos.com/?utm_campaign=github_repo&utm_medium=referral&utm_content=passport_js&utm_source=github"><img src="https://raw.githubusercontent.com/jaredhanson/passport/master/sponsors/workos.png"></a><br/>
+  <a href="https://workos.com/?utm_campaign=github_repo&utm_medium=referral&utm_content=passport_js&utm_source=github"><b>Your app, enterprise-ready.</b><br/>Start selling to enterprise customers with just a few lines of code. Add Single Sign-On (and more) in minutes instead of months.</a>
+</p>
+
+---
+
 Status:
 [![Build](https://travis-ci.org/jaredhanson/passport.svg?branch=master)](https://travis-ci.org/jaredhanson/passport)
 [![Coverage](https://coveralls.io/repos/jaredhanson/passport/badge.svg?branch=master)](https://coveralls.io/r/jaredhanson/passport)

SPONSORS.md

@@ -1,4 +1,11 @@
+## Gold Sponsors
+
+[![LoginRadius](https://raw.githubusercontent.com/jaredhanson/passport/master/sponsors/loginradius.png)](https://www.loginradius.com/)
+<br><br>
+[![WorkOS](https://raw.githubusercontent.com/jaredhanson/passport/master/sponsors/workos.png)](https://workos.com/)
+
 ## Sponsors
 
 - [CodePilot.ai](https://codepilot.ai/)
 - Kelly Burke
+- [Matt Miller](https://mmiller.me/)

lib/authenticator.js

@@ -17,7 +17,6 @@ function Authenticator() {
   this._deserializers = [];
   this._infoTransformers = [];
   this._framework = null;
-  this._userProperty = 'user';
 
   this.init();
 }
@@ -29,7 +28,7 @@ function Authenticator() {
  */
 Authenticator.prototype.init = function() {
   this.framework(require('./framework/connect')());
-  this.use(new SessionStrategy(this.deserializeUser.bind(this)));
+  this.use(new SessionStrategy({ key: this._key }, this.deserializeUser.bind(this)));
   this._sm = new SessionManager({ key: this._key }, this.serializeUser.bind(this));
 };
 
@@ -128,8 +127,6 @@ Authenticator.prototype.framework = function(fw) {
  */
 Authenticator.prototype.initialize = function(options) {
   options = options || {};
-  this._userProperty = options.userProperty || 'user';
-
   return this._framework.initialize(this, options);
 };
 

lib/framework/connect.js

@@ -8,32 +8,15 @@ var initialize = require('../middleware/initialize')
  * Framework support for Connect/Express.
  *
  * This module provides support for using Passport with Express.  It exposes
- * middleware that conform to the `fn(req, res, next)` signature and extends
- * Node's built-in HTTP request object with useful authentication-related
- * functions.
+ * middleware that conform to the `fn(req, res, next)` signature.
  *
  * @return {Object}
  * @api protected
  */
 exports = module.exports = function() {
 
-  // HTTP extensions.
-  exports.__monkeypatchNode();
-
   return {
     initialize: initialize,
     authenticate: authenticate
   };
 };
-
-exports.__monkeypatchNode = function() {
-  var http = require('http');
-  var IncomingMessageExt = require('../http/request');
-
-  http.IncomingMessage.prototype.login =
-  http.IncomingMessage.prototype.logIn = IncomingMessageExt.logIn;
-  http.IncomingMessage.prototype.logout =
-  http.IncomingMessage.prototype.logOut = IncomingMessageExt.logOut;
-  http.IncomingMessage.prototype.isAuthenticated = IncomingMessageExt.isAuthenticated;
-  http.IncomingMessage.prototype.isUnauthenticated = IncomingMessageExt.isUnauthenticated;
-};

lib/http/request.js

@@ -1,10 +1,3 @@
-/**
- * Module dependencies.
- */
-//var http = require('http')
-//  , req = http.IncomingMessage.prototype;
-
-
 var req = exports = module.exports = {};
 
 /**
@@ -35,10 +28,7 @@ req.logIn = function(user, options, done) {
   }
   options = options || {};
 
-  var property = 'user';
-  if (this._passport && this._passport.instance) {
-    property = this._passport.instance._userProperty || 'user';
-  }
+  var property = this._userProperty || 'user';
   var session = (options.session === undefined) ? true : options.session;
 
   this[property] = user;
@@ -63,10 +53,7 @@ req.logIn = function(user, options, done) {
  */
 req.logout =
 req.logOut = function() {
-  var property = 'user';
-  if (this._passport && this._passport.instance) {
-    property = this._passport.instance._userProperty || 'user';
-  }
+  var property = this._userProperty || 'user';
 
   this[property] = null;
   if (this._passport) {
@@ -81,11 +68,7 @@ req.logOut = function() {
  * @api public
  */
 req.isAuthenticated = function() {
-  var property = 'user';
-  if (this._passport && this._passport.instance) {
-    property = this._passport.instance._userProperty || 'user';
-  }
-
+  var property = this._userProperty || 'user';
   return (this[property]) ? true : false;
 };
 

lib/middleware/authenticate.js

@@ -92,12 +92,6 @@ module.exports = function authenticate(passport, name, options, callback) {
   }
 
   return function authenticate(req, res, next) {
-    if (http.IncomingMessage.prototype.logIn
-        && http.IncomingMessage.prototype.logIn !== IncomingMessageExt.logIn) {
-      require('../framework/connect').__monkeypatchNode();
-    }
-
-
     // accumulator for failures from each strategy in the chain
     var failures = [];
 

lib/middleware/initialize.js

@@ -1,3 +1,9 @@
+/**
+ * Module dependencies.
+ */
+var IncomingMessageExt = require('../http/request');
+
+
 /**
  * Passport initialization.
  *
@@ -39,17 +45,24 @@
  * @return {Function}
  * @api public
  */
-module.exports = function initialize(passport) {
+module.exports = function initialize(passport, options) {
+  options = options || {};
 
   return function initialize(req, res, next) {
+    req.login =
+    req.logIn = IncomingMessageExt.logIn;
+    req.logout =
+    req.logOut = IncomingMessageExt.logOut;
+    req.isAuthenticated = IncomingMessageExt.isAuthenticated;
+    req.isUnauthenticated = IncomingMessageExt.isUnauthenticated;
+
+    if (options.userProperty) {
+      req._userProperty = options.userProperty;
+    }
+
     req._passport = {};
     req._passport.instance = passport;
 
-    if (req.session && req.session[passport._key]) {
-      // load data from existing session
-      req._passport.session = req.session[passport._key];
-    }
-
     next();
   };
 };

lib/sessionmanager.js

@@ -15,22 +15,23 @@ SessionManager.prototype.logIn = function(req, user, cb) {
     if (err) {
       return cb(err);
     }
-    if (!req._passport.session) {
-      req._passport.session = {};
-    }
-    req._passport.session.user = obj;
+    // TODO: Error if session isn't available here.
     if (!req.session) {
       req.session = {};
     }
-    req.session[self._key] = req._passport.session;
+    if (!req.session[self._key]) {
+      req.session[self._key] = {};
+    }
+    req.session[self._key].user = obj;
     cb();
   });
 }
 
 SessionManager.prototype.logOut = function(req, cb) {
-  if (req._passport && req._passport.session) {
-    delete req._passport.session.user;
+  if (req.session && req.session[this._key]) {
+    delete req.session[this._key].user;
   }
+
   cb && cb();
 }
 

lib/strategies/session.js

@@ -20,6 +20,7 @@ function SessionStrategy(options, deserializeUser) {
 
   Strategy.call(this);
   this.name = 'session';
+  this._key = options.key || 'passport';
   this._deserializeUser = deserializeUser;
 }
 
@@ -47,8 +48,8 @@ SessionStrategy.prototype.authenticate = function(req, options) {
 
   var self = this, 
       su;
-  if (req._passport.session) {
-    su = req._passport.session.user;
+  if (req.session[this._key]) {
+    su = req.session[this._key].user;
   }
 
   if (su || su === 0) {
@@ -60,10 +61,9 @@ SessionStrategy.prototype.authenticate = function(req, options) {
     this._deserializeUser(su, req, function(err, user) {
       if (err) { return self.error(err); }
       if (!user) {
-        delete req._passport.session.user;
+        delete req.session[self._key].user;
       } else {
-        // TODO: Remove instance access
-        var property = req._passport.instance._userProperty || 'user';
+        var property = req._userProperty || 'user';
         req[property] = user;
       }
       self.pass();

package.json

@@ -1,6 +1,6 @@
 {
   "name": "passport",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Simple, unobtrusive authentication for Node.js.",
   "keywords": [
     "express",
@@ -22,6 +22,10 @@
   "bugs": {
     "url": "http://github.com/jaredhanson/passport/issues"
   },
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/jaredhanson"
+  },
   "license": "MIT",
   "licenses": [
     {

test/authenticator.middleware.test.js

@@ -35,8 +35,8 @@ describe('Authenticator', function() {
         expect(error).to.be.undefined;
       });
 
-      it('should set user property on authenticator', function() {
-        expect(passport._userProperty).to.equal('user');
+      it('should not set user property on request', function() {
+        expect(request._userProperty).to.be.undefined;
       });
 
       it('should not initialize namespace within session', function() {
@@ -48,10 +48,6 @@ describe('Authenticator', function() {
         expect(request._passport.instance).to.be.an.instanceOf(Authenticator);
         expect(request._passport.instance).to.equal(passport);
       });
-
-      it('should not expose session storage on internal request property', function() {
-        expect(request._passport.session).to.be.undefined;
-      });
     });
 
     describe('handling a request with custom user property', function() {
@@ -75,8 +71,8 @@ describe('Authenticator', function() {
         expect(error).to.be.undefined;
       });
 
-      it('should set user property on authenticator', function() {
-        expect(passport._userProperty).to.equal('currentUser');
+      it('should set user property on request', function() {
+        expect(request._userProperty).to.equal('currentUser');
       });
 
       it('should not initialize namespace within session', function() {
@@ -88,10 +84,6 @@ describe('Authenticator', function() {
         expect(request._passport.instance).to.be.an.instanceOf(Authenticator);
         expect(request._passport.instance).to.equal(passport);
       });
-
-      it('should not expose session storage on internal request property', function() {
-        expect(request._passport.session).to.be.undefined;
-      });
     });
 
   });
@@ -278,8 +270,9 @@ describe('Authenticator', function() {
 
             req._passport = {};
             req._passport.instance = {};
-            req._passport.session = {};
-            req._passport.session.user = '123456';
+            req.session = {};
+            req.session['passport'] = {};
+            req.session['passport'].user = '123456';
           })
           .next(function(err) {
             error = err;
@@ -298,8 +291,8 @@ describe('Authenticator', function() {
       });
 
       it('should maintain session', function() {
-        expect(request._passport.session).to.be.an('object');
-        expect(request._passport.session.user).to.equal('123456');
+        expect(request.session['passport']).to.be.an('object');
+        expect(request.session['passport'].user).to.equal('123456');
       });
     });
 

test/http/request.test.js

@@ -1,14 +1,14 @@
 /* global describe, it, expect, before */
 /* jshint expr: true */
 
-var http = require('http')
+var request = require('../../lib/http/request')
   , Passport = require('../..').Passport;
 
-require('../../lib/framework/connect').__monkeypatchNode();
-
 
 describe('http.ServerRequest', function() {
 
+  // TODO: Test that these are extended by initialize/authenticate
+  /*
   describe('prototoype', function() {
     var req = new http.IncomingMessage();
     
@@ -30,16 +30,21 @@ describe('http.ServerRequest', function() {
       expect(req.isUnauthenticated).to.be.an('function');
     });
   });
+  */
 
   describe('#login', function() {
 
     describe('not establishing a session', function() {
       var passport = new Passport();
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req.session['passport'] = {};
 
       var error;
 
@@ -68,18 +73,22 @@ describe('http.ServerRequest', function() {
       });
 
       it('should not serialize user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('not establishing a session and setting custom user property', function() {
       var passport = new Passport();
-      passport._userProperty = 'currentUser';
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req.session['passport'] = {};
+      req._userProperty = 'currentUser';
 
       var error;
 
@@ -112,17 +121,21 @@ describe('http.ServerRequest', function() {
       });
 
       it('should not serialize user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('not establishing a session and invoked without a callback', function() {
       var passport = new Passport();
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req.session['passport'] = {};
 
       var user = { id: '1', username: 'root' };
       req.login(user, { session: false });
@@ -139,12 +152,15 @@ describe('http.ServerRequest', function() {
       });
 
       it('should not serialize user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('not establishing a session, without passport.initialize() middleware', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
 
       var error;
 
@@ -179,10 +195,13 @@ describe('http.ServerRequest', function() {
         done(null, user.id);
       });
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
 
       var error;
 
@@ -211,7 +230,7 @@ describe('http.ServerRequest', function() {
       });
 
       it('should serialize user', function() {
-        expect(req._passport.session.user).to.equal('1');
+        expect(req.session['passport'].user).to.equal('1');
       });
     });
 
@@ -220,12 +239,15 @@ describe('http.ServerRequest', function() {
       passport.serializeUser(function(user, done) {
         done(null, user.id);
       });
-      passport._userProperty = 'currentUser';
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req._userProperty = 'currentUser';
 
       var error;
 
@@ -258,7 +280,7 @@ describe('http.ServerRequest', function() {
       });
 
       it('should serialize user', function() {
-        expect(req._passport.session.user).to.equal('1');
+        expect(req.session['passport'].user).to.equal('1');
       });
     });
 
@@ -268,10 +290,14 @@ describe('http.ServerRequest', function() {
         done(new Error('something went wrong'));
       });
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req.session['passport'] = {};
 
       var error;
 
@@ -299,12 +325,13 @@ describe('http.ServerRequest', function() {
       });
 
       it('should not serialize user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('establishing a session, without passport.initialize() middleware', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
       var user = { id: '1', username: 'root' };
 
       it('should throw an exception', function() {
@@ -320,10 +347,12 @@ describe('http.ServerRequest', function() {
         done(null, user.id);
       });
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.login = request.login;
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
+      req.session = {};
+      req.session['passport'] = {};
 
       var user = { id: '1', username: 'root' };
 
@@ -342,12 +371,16 @@ describe('http.ServerRequest', function() {
     describe('existing session', function() {
       var passport = new Passport();
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.logout = request.logout;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.user = { id: '1', username: 'root' };
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.session = {};
-      req._passport.session.user = '1';
+      req.session = {};
+      req.session['passport'] = {};
+      req.session['passport'].user = '1';
 
       req.logout();
 
@@ -361,20 +394,24 @@ describe('http.ServerRequest', function() {
       });
 
       it('should clear serialized user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('existing session and clearing custom user property', function() {
       var passport = new Passport();
 
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.logout = request.logout;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.currentUser = { id: '1', username: 'root' };
       req._passport = {};
       req._passport.instance = passport;
-      req._passport.instance._userProperty = 'currentUser';
-      req._passport.session = {};
-      req._passport.session.user = '1';
+      req._userProperty = 'currentUser';
+      req.session = {};
+      req.session['passport'] = {};
+      req.session['passport'].user = '1';
 
       req.logout();
 
@@ -388,12 +425,15 @@ describe('http.ServerRequest', function() {
       });
 
       it('should clear serialized user', function() {
-        expect(req._passport.session.user).to.be.undefined;
+        expect(req.session['passport'].user).to.be.undefined;
       });
     });
 
     describe('existing session, without passport.initialize() middleware', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.logout = request.logout;
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.user = { id: '1', username: 'root' };
 
       req.logout();
@@ -414,7 +454,9 @@ describe('http.ServerRequest', function() {
   describe('#isAuthenticated', function() {
 
     describe('with a user', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.user = { id: '1', username: 'root' };
 
       it('should be authenticated', function() {
@@ -424,11 +466,13 @@ describe('http.ServerRequest', function() {
     });
 
     describe('with a user set on custom property', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.currentUser = { id: '1', username: 'root' };
       req._passport = {};
       req._passport.instance = {};
-      req._passport.instance._userProperty = 'currentUser';
+      req._userProperty = 'currentUser';
 
       it('should be authenticated', function() {
         expect(req.isAuthenticated()).to.be.true;
@@ -437,7 +481,9 @@ describe('http.ServerRequest', function() {
     });
 
     describe('without a user', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
 
       it('should not be authenticated', function() {
         expect(req.isAuthenticated()).to.be.false;
@@ -446,7 +492,9 @@ describe('http.ServerRequest', function() {
     });
 
     describe('with a null user', function() {
-      var req = new http.IncomingMessage();
+      var req = new Object();
+      req.isAuthenticated = request.isAuthenticated;
+      req.isUnauthenticated = request.isUnauthenticated;
       req.user = null;
 
       it('should not be authenticated', function() {

test/middleware/initialize.test.js

@@ -37,10 +37,6 @@ describe('middleware/initialize', function() {
       expect(request._passport.instance).to.be.an.instanceOf(Passport);
       expect(request._passport.instance).to.equal(passport);
     });
-
-    it('should not expose empty object as session storage on internal request property', function() {
-      expect(request._passport.session).to.be.undefined;
-    });
   });
 
   describe('handling a request with a new session', function() {
@@ -74,10 +70,6 @@ describe('middleware/initialize', function() {
       expect(request._passport.instance).to.be.an.instanceOf(Passport);
       expect(request._passport.instance).to.equal(passport);
     });
-
-    it('should not expose session storage on internal request property', function() {
-      expect(request._passport.session).to.be.undefined;
-    });
   });
 
   describe('handling a request with an existing session', function() {
@@ -115,12 +107,6 @@ describe('middleware/initialize', function() {
       expect(request._passport.instance).to.be.an.instanceOf(Passport);
       expect(request._passport.instance).to.equal(passport);
     });
-
-    it('should expose session storage on internal request property', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(Object.keys(request._passport.session)).to.have.length(1);
-      expect(request._passport.session.user).to.equal('123456');
-    });
   });
 
   describe('handling a request with an existing session using custom session key', function() {
@@ -159,12 +145,6 @@ describe('middleware/initialize', function() {
       expect(request._passport.instance).to.be.an.instanceOf(Passport);
       expect(request._passport.instance).to.equal(passport);
     });
-
-    it('should expose session storage on internal request property', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(Object.keys(request._passport.session)).to.have.length(1);
-      expect(request._passport.session.user).to.equal('123456');
-    });
   });
 
 });

test/strategies/session.pause.test.js

@@ -33,8 +33,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate({ pauseStream: true });
     });
@@ -53,8 +54,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should maintain session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.equal('123456');
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.equal('123456');
     });
 
     it('should pause request', function() {
@@ -95,8 +96,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate({ pauseStream: true });
     });
@@ -114,8 +116,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should remove user from session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.be.undefined;
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.be.undefined;
     });
 
     it('should pause request', function() {

test/strategies/session.test.js

@@ -26,7 +26,8 @@ describe('SessionStrategy', function() {
           request = req;
 
           req._passport = {};
-          req._passport.session = {};
+          req.session = {};
+          req.session['passport'] = {};
         })
         .authenticate();
     });
@@ -58,8 +59,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate();
     });
@@ -74,8 +76,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should maintain session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.equal('123456');
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.equal('123456');
     });
   });
 
@@ -97,8 +99,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = 0;
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = 0;
         })
         .authenticate();
     });
@@ -113,8 +116,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should maintain session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.equal(0);
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.equal(0);
     });
   });
 
@@ -136,8 +139,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate();
     });
@@ -151,8 +155,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should remove user from session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.be.undefined;
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.be.undefined;
     });
   });
 
@@ -174,9 +178,10 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.instance._userProperty = 'currentUser';
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req._userProperty = 'currentUser';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate();
     });
@@ -213,8 +218,9 @@ describe('SessionStrategy', function() {
 
           req._passport = {};
           req._passport.instance = {};
-          req._passport.session = {};
-          req._passport.session.user = '123456';
+          req.session = {};
+          req.session['passport'] = {};
+          req.session['passport'].user = '123456';
         })
         .authenticate();
     });
@@ -229,8 +235,8 @@ describe('SessionStrategy', function() {
     });
 
     it('should maintain session', function() {
-      expect(request._passport.session).to.be.an('object');
-      expect(request._passport.session.user).to.equal('123456');
+      expect(request.session['passport']).to.be.an('object');
+      expect(request.session['passport'].user).to.equal('123456');
     });
   });