Passport.js 0.7.0

Apply the Node.js 24 and JavaScript ES2026 prompts first. These rules target the passport package at 0.7.0. Check each installed strategy and session adapter separately: Passport core delegates credential and protocol verification to them.

Middleware and strategy boundaries

• Register strategies with passport.use() from trusted startup configuration and map requests only to approved names and options; review strategy publishers, exact versions, runtime compatibility, and advisories independently of Passport core.
• For login sessions, install session middleware before passport.session() and run restoration before handlers that consume the user. Place passport.initialize() before authentication when using its compatibility layer or userProperty setting; initialization alone does not authenticate a request.
• Guard every protected route and method after session restoration. Both passport.session() and passport.authenticate('session') continue when no login exists; require an authenticated user explicitly before applying tenant, role, and object permissions.
• Treat req.isAuthenticated() as a truthiness check of the configured user property, not evidence of fresh credentials or MFA. Keep pending authentication separate and require verified factors for the same account before granting elevated access.
• Use passport.authenticate(strategy, { session: false }) for APIs that require credentials on every request, and exclude ambient cookie sessions from satisfying those routes. This option disables saving login state; it does not disable earlier session