能否在现有Node用户认证体系中新增Passport-JWT适配React Native？

I've built a web app using Node.js, Express, MongoDB, and Passport, implementing session-based user authentication with passport-local-mongoose. Here's my User model code:

const mongoose = require("mongoose");
const passportLocalMongoose = require("passport-local-mongoose");
var UserSchema = new mongoose.Schema({
  username: String,
  email: String,
  password: String,
  //etc
});
UserSchema.plugin(passportLocalMongoose);
module.exports = mongoose.model("User", UserSchema);

Now I need to develop a React Native client for this app and want to reuse the existing user database. I'm wondering: Can I use Passport-JWT alongside my current user model and authentication strategy? Or should I refactor the project to use only JSON Web Token authentication and import existing user data?

Great question! Both approaches are feasible, but which one you pick depends on your long-term goals and how much refactoring you’re open to. Let’s break down both options clearly:

Option 1: Support Both Session-Based Auth (Web) and JWT (React Native) — Recommended #

You absolutely can run both Passport strategies side by side without touching your existing User model or database. This is the lowest-effort path because you get to reuse all your current code while adding support for React Native seamlessly.

Here’s how to pull it off:

1. Add Passport-JWT dependency: Install passport-jwt and jsonwebtoken via npm/yarn.
2. Configure the JWT strategy: Set up a new Passport strategy that extracts JWT tokens from the Authorization: Bearer <token> header, then validates them by looking up users in your existing database. Since passport-local-mongoose already handles password hashing and user serialization, your User schema works as-is—you just need to query users by ID from the JWT payload.
   Example strategy code:

   const passportJWT = require("passport-jwt");
   const JWTStrategy = passportJWT.Strategy;
   const ExtractJWT = passportJWT.ExtractJwt;
   const User = require("./models/User");
   const jwt = require("jsonwebtoken");
   
   passport.use(new JWTStrategy({
       jwtFromRequest: ExtractJWT.fromAuthHeaderAsBearerToken(),
       secretOrKey: process.env.JWT_SECRET // Use a secure environment variable for this
     },
     (jwtPayload, done) => {
       return User.findById(jwtPayload.id)
         .then(user => done(null, user))
         .catch(err => done(err));
     }
   ));
   

3. Update your login endpoint: Tweak your existing login route to generate and return a JWT when authentication succeeds (alongside setting the session cookie for web users). Your React Native client will store this token and send it in headers for future requests.
   Example login route snippet:

   app.post("/login", passport.authenticate("local"), (req, res) => {
     // Generate JWT for React Native
     const token = jwt.sign({ id: req.user._id }, process.env.JWT_SECRET, { expiresIn: "7d" });
     // Return user data + token to the client
     res.json({ user: req.user, token });
   });
   

4. Protect RN-facing routes: Use passport.authenticate("jwt", { session: false }) as middleware for routes the React Native app will access—since RN doesn’t handle browser-style sessions.

Pros: No database migration needed, existing web app works unchanged, minimal code changes overall.
Cons: You’ll maintain two authentication strategies, but this is easy to manage with clean code organization.

Option 2: Refactor to JWT-Only Authentication #

If you’re planning to shift your entire app to a stateless, JWT-only architecture (or just prefer not to maintain two strategies), refactoring is also viable—and you don’t even need to import existing user data.

Your current User model (with passport-local-mongoose applied) is fully compatible with JWT:

• passport-local-mongoose already hashes passwords correctly, so you can still use the local strategy to verify login credentials, then return a JWT instead of creating a session.
• You’ll just need to remove session-related middleware (like express-session) and update all protected routes to use the JWT strategy.

Pros: Single authentication flow across all clients, stateless setup that can simplify scaling.
Cons: Requires rewriting your existing web app’s authentication logic, which adds upfront work and potential for migration bugs.

Final Recommendation #

Start with Option 1. It lets you launch your React Native app quickly while keeping your web app intact. If later you decide to switch to JWT-only, you can gradually phase out the session strategy without disrupting users or needing to migrate data.

内容的提问来源于stack exchange，提问作者Alejandro