diff --git a/lib/middleware/initialize.js b/lib/middleware/initialize.js index 0b9760e4..47ba7e86 100644 --- a/lib/middleware/initialize.js +++ b/lib/middleware/initialize.js @@ -55,8 +55,31 @@ module.exports = function initialize(passport, options) { var compat = (options.compat === undefined) ? true : options.compat; if (compat) { - // NOTE: Compat mode also requires that the `passport` instance have - // an `_sm` variable set to the SessionManager. + // `passport@0.5.1` [removed][1] all internal use of `req._passport`. + // From the standpoint of this package, this should have been a + // non-breaking change. However, some strategies (such as `passport-azure-ad`) + // depend directly on `passport@0.4.x` or earlier. `require`-ing earlier + // versions of `passport` has the effect of monkeypatching `http.IncomingMessage` + // with `logIn`, `logOut`, `isAuthenticated` and `isUnauthenticated` + // functions that [expect][2] the `req._passport` property to exist. + // Since pre-existing functions on `req` are given [preference][3], this + // results in [issues][4]. + // + // The changes here restore the expected properties needed when earlier + // versions of `passport` are `require`-ed. This compatibility mode is + // enabled by default, and can be disabld by simply not `use`-ing `passport.initialize()` + // middleware or setting `compat: false` as an option to the middleware. + // + // An alternative approach to addressing this issue would be to not + // preferentially use pre-existing functions on `req`, but rather always + // overwrite `req.logIn`, etc. with the versions of those functions shiped + // with `authenticate()` middleware. This option should be reconsidered + // in a future major version release. + // + // [1]: https://github.com/jaredhanson/passport/pull/875 + // [2]: https://github.com/jaredhanson/passport/blob/v0.4.1/lib/http/request.js + // [3]: https://github.com/jaredhanson/passport/blob/v0.5.1/lib/middleware/authenticate.js#L96 + // [4]: https://github.com/jaredhanson/passport/issues/877 passport._userProperty = options.userProperty || 'user'; req._passport = {};