{"action":"created","issue":{"url":"https://api.github.com/repos/expressjs/session/issues/253","labels_url":"https://api.github.com/repos/expressjs/session/issues/253/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/session/issues/253/comments","events_url":"https://api.github.com/repos/expressjs/session/issues/253/events","html_url":"https://github.com/expressjs/session/issues/253","id":125691703,"number":253,"title":"Looking for a solution to store OAuth 2 access tokens and exchange with client requests","user":{"login":"parky128","id":10373419,"avatar_url":"https://avatars.githubusercontent.com/u/10373419?v=3","gravatar_id":"","url":"https://api.github.com/users/parky128","html_url":"https://github.com/parky128","followers_url":"https://api.github.com/users/parky128/followers","following_url":"https://api.github.com/users/parky128/following{/other_user}","gists_url":"https://api.github.com/users/parky128/gists{/gist_id}","starred_url":"https://api.github.com/users/parky128/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parky128/subscriptions","organizations_url":"https://api.github.com/users/parky128/orgs","repos_url":"https://api.github.com/users/parky128/repos","events_url":"https://api.github.com/users/parky128/events{/privacy}","received_events_url":"https://api.github.com/users/parky128/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/expressjs/session/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-08T20:54:36Z","updated_at":"2016-01-09T21:53:50Z","closed_at":null,"body":"I have recently come across this library which sounds like what I may need for my Express app to securely store access tokens for logged in users from an OAuth 2 server.\r\n\r\nI don't want access tokens being returned back to the client, but after a user has successfully logged in and their token been returned from the OAuth 2 server then the token must be used for subsequent requests, set as an Authorization bearer header.\r\n\r\nSo looking at this library, do I understand correctly that the token can be saved in a store that Express can access, e.g. mongoDB, Redis. And a session cookie can then be used which is then used in subsequent request by the client and used by Express to retrieve from this store?\r\n\r\nI'm pretty new to using Express and safely using tokens, so please excuse my ignorance.\r\n\r\nI'm just struggling to find any worked examples out there that can give me proper guidance, this library seems to be a potential solution.\r\n\r\nCan someone kindly give me some further advise please?\r\n"},"comment":{"url":"https://api.github.com/repos/expressjs/session/issues/comments/170285467","html_url":"https://github.com/expressjs/session/issues/253#issuecomment-170285467","issue_url":"https://api.github.com/repos/expressjs/session/issues/253","id":170285467,"user":{"login":"parky128","id":10373419,"avatar_url":"https://avatars.githubusercontent.com/u/10373419?v=3","gravatar_id":"","url":"https://api.github.com/users/parky128","html_url":"https://github.com/parky128","followers_url":"https://api.github.com/users/parky128/followers","following_url":"https://api.github.com/users/parky128/following{/other_user}","gists_url":"https://api.github.com/users/parky128/gists{/gist_id}","starred_url":"https://api.github.com/users/parky128/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parky128/subscriptions","organizations_url":"https://api.github.com/users/parky128/orgs","repos_url":"https://api.github.com/users/parky128/repos","events_url":"https://api.github.com/users/parky128/events{/privacy}","received_events_url":"https://api.github.com/users/parky128/received_events","type":"User","site_admin":false},"created_at":"2016-01-09T21:53:50Z","updated_at":"2016-01-09T21:53:50Z","body":"Thanks for the reply, I really appreciate your time.\r\n\r\nI am unsure whether I really need to use Passport at all since the workflow I \r\n\r\n* User submits credentials\r\n* Express handles /login POST request from client in a route handler\r\n  * /login POST handler requests an access token from an OAuth 2 provider\r\n* Access token needs to be stored and an associated cookie (signed) sent back in response to client\r\n* In all further api requests from the client, if cookie is present, corresponding token is retrieved from store server side and used as a bearer token header for ongoing request to separate endpoint.\r\n\r\nI already have the first two points working in my setup, and the remaining steps given what you have now said and reading back over the docs, I believe can all be achieved using express-session and a configured stored (mongo, redis, etc) alone.\r\n\r\nI don't see what extra benefits Passport would give, I find their docs quite hard to follow!\r\n\r\n\r\n"}}