passport-github2

passport-github2 is a Passport strategy that authenticates users against GitHub’s OAuth 2.0 API. It is a community-maintained fork of the original passport-github module, republished under a new name after GitHub moved its API to v3 and the original author stopped maintaining the package.

It plugs directly into Passport’s use()/authenticate() flow, exchanging an OAuth authorization code for an access token and a normalized GitHub profile, so it works unobtrusively with Express or any other Connect-style middleware stack.

What You Get

• A GitHubStrategy class ready to register with passport.use()
• Automatic OAuth 2.0 authorization-code exchange for an access token
• A normalized GitHub user profile (id, username, display name, emails, photos) attached to the verify callback
• Configurable OAuth scopes (e.g. user:email) passed straight to passport.authenticate()
• Drop-in compatibility with Express and any Connect-style middleware stack
• A working login example under examples/login demonstrating a full auth flow

Common Use Cases

• Adding a “Sign in with GitHub” button to an Express application using Passport as the auth layer
• Building a developer-tool dashboard that needs to identify users by their GitHub account
• Bootstrapping OAuth-based login for internal tools where GitHub org membership doubles as access control
• Migrating an app off the unmaintained original passport-github package onto an actively compatible fork

Under The Hood

Architecture: The package is a thin, three-file library: lib/strategy.js (161 lines) defines Strategy, which extends passport-oauth2’s base OAuth2Strategy, overriding userProfile() to call GitHub’s /user API endpoint and normalize the response through lib/profile.js’s parse() function into a Passport-standard profile object (id, displayName, username, emails, photos). lib/index.js (15 lines) is a small barrel file exporting Strategy both as the module’s default export and as a Strategy property, matching the conventions of the wider passport-* strategy ecosystem. Tech Stack: Plain Node.js (CommonJS, engines: >= 0.8.0) with a single runtime dependency, passport-oauth2 (pinned to the 1.x.x range), which itself implements the generic OAuth 2.0 dance; dev dependencies are mocha and chai for testing, run via a Makefile/npm test script, plus Travis CI for continuous testing. Code Quality: The repo has a real, focused test suite (test/strategy.test.js, test/strategy.options.test.js, test/strategy.profile.test.js, test/profile.test.js, test/package.test.js — 370 lines total) that exercises strategy construction, custom option handling, and profile parsing against fixture GitHub API responses (test/data/octocat-20190115.json, test/data/example.json), giving reasonable confidence the OAuth flow and profile mapping behave as documented. Development activity is otherwise low — the repo hasn’t seen a push since late 2023 — so it should be treated as stable-but-dormant rather than actively evolving. API Design: The strategy follows Passport’s well-established new GitHubStrategy({clientID, clientSecret, callbackURL}, verify) convention, which means anyone who has used another passport-* strategy can adopt it with near-zero learning curve; the README’s copy-pasteable Express route example (passport.authenticate('github', {...})) covers the entire integration surface for the common case.