passport-local

passport-local is the official Passport strategy for username-and-password authentication in Node.js. It lets you add classic password-based sign in to any application built on Connect-style middleware, including Express, by wiring a single verify callback that checks the submitted credentials against your own user store.

Because it plugs into Passport’s unified authentication framework, passport-local stays deliberately small and unopinionated: it extracts the username and password from the request, hands them to your verify function, and leaves password hashing, session handling, and user lookup entirely up to you. That separation makes it the de facto standard for local login across the Node.js ecosystem.

What You Get

• A drop-in local strategy that integrates with Passport’s authenticate() middleware
• A single verify-callback contract for validating credentials against any user store
• Configurable form field names via usernameField and passwordField options
• Optional access to the request object in the verify callback through passReqToCallback

Common Use Cases

• Adding email/password login to an Express application
• Authenticating API requests with credentials submitted from an HTML form
• Building a custom sign-in flow backed by your own database and password hashing

Under The Hood

Architecture The module is a compact strategy-pattern implementation split across three files in lib/: index.js re-exports the Strategy constructor, strategy.js defines it, and utils.js holds a single lookup helper. Strategy extends passport.Strategy from the passport-strategy base via util.inherits, and its authenticate(req, options) method pulls the username and password from req.body or req.query, short-circuits with this.fail() on missing credentials, and otherwise invokes the user-supplied verify callback, routing its result through this.error, this.fail, or this.success.

Tech Stack Written in plain ES5 JavaScript with a single runtime dependency, passport-strategy (1.x), and Node’s built-in util. It declares engines.node >= 0.4.0 and uses main: ./lib. Development tooling is minimal: Mocha and Chai (with chai-passport-strategy) driven through a Makefile, plus make-node for build scaffolding.

Code Quality For its size the codebase is well covered: eight Mocha test files under test/ exercise the normal, failure, error, custom-fields, options, and passReqToCallback paths. The source is thoroughly documented with JSDoc, including annotated callback contracts and usage examples. It reflects its age with var declarations and callback-style APIs rather than modern async/await, but the logic is tight and readable.

API Design The public surface is a single constructor that accepts an optional options hash and a verify callback, throwing a TypeError when the callback is missing. Getting started requires almost no boilerplate, field names are trivially remappable, and the verify contract is consistent with the rest of the Passport ecosystem, making the developer experience approachable and predictable.