title: Passport.js: How does the verify callback work?
body: <p>I am trying to figure out the Passport.js authentication mechanism, and there is one confusing point for me.</p>
  <p>The following is the <code>.use()</code> function's implementation:</p>
  <pre><code>Authenticator.prototype.use = function(name, strategy) {
    if (!strategy) {
      strategy = name;
      name = strategy.name;
    }
    if (!name) { throw new Error('Authentication strategies must have a name'); }
    
    this._strategies[name] = strategy;
    return this;
  };
  </code></pre>
  <p>My understanding is that this function registers <code>strategy</code> into the <code>_strategies</code> property.</p>
  <p>For example, I use the <code>JWT</code> strategy as following:</p>
  <pre><code>passport.use(new JwtStrategy(opts, function(jwt_payload, done) {
      User.findOne({id: jwt_payload.sub}, function(err, user) {
          if (err) {
              return done(err, false);
          }
          if (user) {
              return done(null, user);
          } else {
              return done(null, false);
              // or you could create a new account
          }
      });
  }));
  </code></pre>
  <p>The <code>verify callback</code> is provided. So in this way, the authentication strategy is configured. <br></p>
  <p>Then in the API route, we can use <code>passport.authenticate('jwt')</code> method as a middleware to authenticate the incoming request. <br></p>
  <p>I check the implementation of the Passport.js (the authenitcate.js file). I found that in fact, the named strategy's <code>authenticate</code> function will be invoked for the auth process.<br></p>
  <p>So how does the verify callback work? When and where it's called?</p>
  <p>Edit:
  After more debugging, I found the verify callback was called in the specific strategy's authenticate function. following is the passport-jwt strategy:</p>
  <pre><code>JwtStrategy.prototype.authenticate = function(req, options) {
      var self = this;
  
      var token = self._jwtFromRequest(req);
  
      if (!token) {
          return self.fail(new Error(&quot;No auth token&quot;));
      }
  
      this._secretOrKeyProvider(req, token, function(secretOrKeyError, secretOrKey) {
          if (secretOrKeyError) {
              self.fail(secretOrKeyError)
          } else {
              // Verify the JWT
              JwtStrategy.JwtVerifier(token, secretOrKey, self._verifOpts, function(jwt_err, payload) {
                  if (jwt_err) {
                      return self.fail(jwt_err);
                  } else {
                      // Pass the parsed token to the user
                      var verified = function(err, user, info) {
                          if(err) {
                              return self.error(err);
                          } else if (!user) {
                              return self.fail(info);
                          } else {
                              return self.success(user, info);
                          }
                      };
  
                      try {
                          if (self._passReqToCallback) {
                              self._verify(req, payload, verified);
                          } else {
                              self._verify(payload, verified);
                          }
                      } catch(ex) {
                          self.error(ex);
                      }
                  }
              });
          }
      });
  };
  </code></pre>
  <p>the <code>self._verify</code> is in fact the verify callback defined in the configure process.</p>