Express session vs. PassportJS session

Question

Do Express session and Passport session conflict in an Express app? Why or why not?

Here is some code that distinguishes Express and Passport session objects:

    app.use(express.session({}));     app.use(passport.session());      app.use(session({         cookie : {             maxAge : 60000         }     })); 

Answer 1

No, they are two separate things and they do not conflict which other. Moreover, passport.session has to be used after express.session in order to work properly.

express.session middleware is used to retrieve user session from a datastore (like Redis). We can find the session object because the session Id is stored in the cookie, which is provided to the server with every request.

Then, the purpose of passport.session middleware is to deserialize user object from session using passport.deserializeUser function (that you define in your passport configuration). When user first authenticates itself, its user object is serialized and stored in the session. On each following request, the middleware deserialize the user and populates req.user object.

Check Passpot Configure Guide and this SO answer: What does passport.session() middleware do? for more information.