如何让Passport.js的isLoggedIn中间件兼容Local与Slack策略？

Let's break down why your Slack-authenticated users are getting blocked by the isLoggedIn middleware—it’s not the middleware itself that’s the problem, but how you’re handling the Slack authentication flow. Here’s how to fix it step by step:

1. Use passport.authenticate() Instead of passport.authorize() for Slack Routes #

passport.authorize() is designed for linking third-party accounts to an already logged-in user, not for authenticating users from scratch. For Slack login, you need passport.authenticate() to create a new authenticated session:

// Replace your existing Slack routes with these
app.get('/auth/slack', passport.authenticate('slack')); // Redirects user to Slack's authorization page

app.get('/auth/slack/callback', passport.authenticate('slack', {
    successRedirect: "/QAApplicationHub",
    failureRedirect: "/login",
    failureFlash: true
}));

Note: Slack OAuth flows typically use GET requests for the initial redirect and callback, so we’ve adjusted the route methods here to match that standard.

2. Fix the Slack Strategy Callback to Persist User Data #

Right now you’re passing profiles.user directly to done(), but if you’re using a database (e.g., MongoDB with a User model), you need to either find an existing user by their Slack ID or create a new one. This ensures the user is properly stored and can be serialized into the session:

passport.use(new SlackStrategy({
    clientID: process.env.SLACK_CLIENT_ID, // Use environment variables instead of hardcoding
    clientSecret: process.env.SLACK_CLIENT_SECRET,
    callbackURL: "/auth/slack/callback" // Must match the callback URL set in your Slack app dashboard
}, async (accessToken, scopes, team, extra, profiles, done) => {
    try {
        // Check if a user with this Slack ID already exists
        const existingUser = await User.findOne({ slackId: profiles.user.id });
        
        if (existingUser) {
            return done(null, existingUser);
        }

        // Create a new user if none exists
        const newUser = new User({
            name: profiles.user.name,
            email: profiles.user.email,
            slackId: profiles.user.id
            // Add any other fields you need for your user model
        });

        await newUser.save();
        done(null, newUser);
    } catch (err) {
        done(err, null);
    }
}));

Important: Double-check that the callbackURL matches exactly what you’ve configured in your Slack app’s settings—mismatched URLs will break the authentication flow.

3. Ensure Serialize/Deserialize Functions Work for All User Types #

Passport relies on serialize/deserialize functions to store user data in the session and retrieve it later. Make sure these functions use a universal identifier (like your database’s _id) that works for both Local and Slack-created users:

// Serialize user data into the session
passport.serializeUser((user, done) => {
    done(null, user.id); // Use the user's unique database ID, regardless of authentication method
});

// Deserialize user data from the session
passport.deserializeUser(async (id, done) => {
    try {
        const user = await User.findById(id);
        done(null, user);
    } catch (err) {
        done(err, null);
    }
});

If your original serialize/deserialize logic was tied to Local-specific fields (like username), updating it to use the database ID will ensure it works for all user types.

4. Verify the isLoggedIn Middleware #

Your existing isLoggedIn middleware is already correct! req.isAuthenticated() is a Passport method that checks if any authentication strategy successfully established a session. The issue was that Slack authentication wasn’t properly creating that session—once you fix the steps above, this middleware will recognize both Local and Slack-authenticated users.

Once you implement these changes, users logging in via Slack will have their session properly established, and the isLoggedIn middleware will grant them access to /QAApplicationHub without blocking them.

内容的提问来源于stack exchange，提问作者Mark White