passport-google-oauth20

passport-google-oauth20 implements a Passport.js Strategy for authenticating users against Google’s OAuth 2.0 endpoints, handling the authorization-code exchange, access-token retrieval, and mapping of Google’s userinfo response into Passport’s normalized profile shape. It’s built directly on top of passport-oauth2, the generic OAuth2 strategy base class, and adds only the Google-specific endpoint URLs, scope handling, and profile parsing on top.

As part of the broader Passport strategy ecosystem maintained by Jared Hanson, it plugs into any Express/Connect-based Node.js app already using Passport for authentication, letting an app add “Sign in with Google” alongside other configured strategies (local, other OAuth providers) through the same consistent passport.authenticate() interface.

What You Get

• A Strategy class implementing Google’s OAuth 2.0 authorization-code flow for Passport.js
• Automatic exchange of the authorization code for an access token against Google’s token endpoint
• A verify callback pattern receiving accessToken, refreshToken, and a normalized profile object
• Configurable scope option for requesting specific Google API access alongside basic profile/email
• Google-specific profile parsing (lib/profile/) mapping raw userinfo JSON into Passport’s standard profile schema

Common Use Cases

• Adding a “Sign in with Google” button to an Express/Node.js web application already using Passport for session-based auth
• Combining Google OAuth login with other Passport strategies (local username/password, Facebook, GitHub) under one consistent auth flow
• Requesting incremental Google API scopes (e.g. Calendar, Drive) during the same OAuth consent flow used for identity
• Server-side session establishment after Google login, storing the returned profile/tokens for later use

Under The Hood

Architecture - lib/strategy.js (199 lines) extends passport-oauth2’s base OAuth2Strategy, hardcoding Google’s https://accounts.google.com/o/oauth2/v2/auth and token endpoint URLs, and overriding the userProfile method to fetch https://www.googleapis.com/oauth2/v3/userinfo and hand the response to one of the parsers in lib/profile/ (openid.js for the newer OpenID Connect-shaped payload, googleplus.js for the legacy Google+ profile shape) depending on response format; lib/errors/ wraps Google-specific API error responses (userinfoerror.js, googleplusapierror.js) into typed error objects Passport can surface consistently. Tech Stack - Plain CommonJS JavaScript with a single runtime dependency, passport-oauth2, which itself wraps the oauth npm package for the underlying OAuth2 HTTP exchange; no build step or TypeScript types are involved. Code Quality - test/ includes dedicated suites for the strategy’s auth flow (strategy.test.js), profile parsing (strategy.profile.test.js, test/profile/), and package metadata (package.test.js) run via Mocha/Chai with chai-passport-strategy helpers, but the repo shows no commits or releases in recent activity data, consistent with the broader Passport ecosystem’s maintenance mode. API Design - Follows Passport’s standard strategy contract exactly (new Strategy(options, verify), then passport.use()), so anyone already familiar with any other Passport strategy can adopt this one with just a swap of clientID/clientSecret/callbackURL — the tradeoff is a very small, single-purpose surface with no higher-level convenience beyond what Passport itself provides.