{"action":"created","issue":{"url":"https://api.github.com/repos/jaredhanson/passport/issues/520","repository_url":"https://api.github.com/repos/jaredhanson/passport","labels_url":"https://api.github.com/repos/jaredhanson/passport/issues/520/labels{/name}","comments_url":"https://api.github.com/repos/jaredhanson/passport/issues/520/comments","events_url":"https://api.github.com/repos/jaredhanson/passport/issues/520/events","html_url":"https://github.com/jaredhanson/passport/issues/520","id":185714646,"number":520,"title":"can authentication proceed without deserializeUser?","user":{"login":"godmar","id":486389,"avatar_url":"https://avatars.githubusercontent.com/u/486389?v=3","gravatar_id":"","url":"https://api.github.com/users/godmar","html_url":"https://github.com/godmar","followers_url":"https://api.github.com/users/godmar/followers","following_url":"https://api.github.com/users/godmar/following{/other_user}","gists_url":"https://api.github.com/users/godmar/gists{/gist_id}","starred_url":"https://api.github.com/users/godmar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/godmar/subscriptions","organizations_url":"https://api.github.com/users/godmar/orgs","repos_url":"https://api.github.com/users/godmar/repos","events_url":"https://api.github.com/users/godmar/events{/privacy}","received_events_url":"https://api.github.com/users/godmar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-27T16:13:25Z","updated_at":"2016-12-28T09:32:28Z","closed_at":null,"body":"This is more a question/feature discussion than a bug report.\n\nIn Passport, the `serializeUser` and `deserializeUser` functions are required. I believe the typical use is as follows: `serializeUser` picks some 'id' from a larger user object and stores it in the session state. `deserializeUser` looks up current information about the user from somewhere, typically a fast cache such as Redis, and restores the user object with appropriate attributes for access via `req.user` by subsequent middleware.\n\nIf my understanding is correct, a problem with this set up is that at least some requests for authenticated users actually do not need additional information about the user, such as those requests that serve information to any authenticated user. In those cases, the time spent retrieving this information is wasted. \n(But passport still needs to be in the middleware chain for those requests since they do require authentication!)\n\nTo address this issue, it is possible to not have `deserializeUser` restore a user object, but just restore what's in the session state. Then subsequent code would have to fetch it, perhaps using a Promise.\n\nI'm wondering if this use case is strong/frequent enough that it would warrant consideration for being included in passport itself.  Certainly (or likely?), the current recommended default setup can lead to undesired inefficiencies when users are deserialized via a cache and then no attributes of the deserialized user is accessed by subsequent middleware.\n\nFor instance, passport could have one middleware that just checks authentication (but does not call `deserializeUser`), and provide another middleware that deserializes the user. Maybe that's already possible?\n"},"comment":{"url":"https://api.github.com/repos/jaredhanson/passport/issues/comments/269451280","html_url":"https://github.com/jaredhanson/passport/issues/520#issuecomment-269451280","issue_url":"https://api.github.com/repos/jaredhanson/passport/issues/520","id":269451280,"user":{"login":"woutr","id":24378717,"avatar_url":"https://avatars.githubusercontent.com/u/24378717?v=3","gravatar_id":"","url":"https://api.github.com/users/woutr","html_url":"https://github.com/woutr","followers_url":"https://api.github.com/users/woutr/followers","following_url":"https://api.github.com/users/woutr/following{/other_user}","gists_url":"https://api.github.com/users/woutr/gists{/gist_id}","starred_url":"https://api.github.com/users/woutr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/woutr/subscriptions","organizations_url":"https://api.github.com/users/woutr/orgs","repos_url":"https://api.github.com/users/woutr/repos","events_url":"https://api.github.com/users/woutr/events{/privacy}","received_events_url":"https://api.github.com/users/woutr/received_events","type":"User","site_admin":false},"created_at":"2016-12-28T09:32:28Z","updated_at":"2016-12-28T09:32:28Z","body":"Not sure if you've already solved your own question, but the `serializeUser` and `deserializeUser` is only required when you are using session.\r\n\r\nYou can use different authentication strategies do use passport without sessions, such as `jwt` or `bearer tokens`."}}
{"actor":{"display_login":"woutr"}}