nodejs passport authentication token

Simply use the access token on every request. Using a session is NOT needed. The following is the workflow:

POST /signin

1. The username and password are posted in the client request.
2. The server authenticates the user by using passport’s Local Strategy. See passport-local.
3. If the credentials represent a valid user, the server returns the access token generated by some generator. node-jwt-simple is a good choice.
4. If the credentials are invalid, redirect to /signin.

When the client receives the access token from the authorization server, it can then make requests to protected resources on the server. For example:

GET /api/v1/somefunction?token='abcedf'

1. The client calls some server api with the token argument.
2. The server authenticates the token by using passport’s Bearer Strategy. See passport-http-bearer.

References

Make a secure oauth API with passport.js and express.js (node.js)