Problem with newer Passport versions

[dladeira]

Newer passport versions give this error: TypeError: Cannot set properties of undefined (setting 'user')

This stack overflow post describes the issue pretty well: https://stackoverflow.com/questions/72916291/passport-fail-to-serializeuser-typeerror-cannot-set-properties-of-undefined-s

In my case, my passport strategy depended on an older version of passport-oauth, which in turn depended on a version of passport prior to 0.5.1. In 0.5.1, passport was updated to move where the passport session is kept (no longer at req._passport.session). The older version of passport was expecting to find it there. Here are a couple things you can check to track down your issue.

Edit from the future:

This repo seems dead. For everyone with the same issue and you need passport >5.1, you can use a custom Passport OAuth2Strategy. Here's the config that I use:

import OAuth2Strategy from "passport-oauth2"

const fetchStravaProfile = async (accessToken, done) => {
    const res = await fetch(`https://www.strava.com/api/v3/athlete`, {
        headers: {
            Authorization: `Bearer ${accessToken}`,
        },
    })

    const profile = await res.json()

    done(null, profile)
}

const strava0AuthConfig = {
    authorizationURL: `http://www.strava.com/oauth/authorize?`,
    tokenURL: `https://www.strava.com/oauth/token`,
    clientID: process.env["STRAVA_ID"],
    clientSecret: process.env["STRAVA_SECRET"],
    callbackURL: `${process.env["API_SERVER"]}/strava/redirect`,
    state: true,
    scope: ["profile:read_all,activity:read_all"],
    passReqToCallback: true,
}

const stravaCallback = async (req, accessToken, refreshToken, { expires_in }, profile, done) => {
    console.log(accessToken, refreshToken, profile, done)
    // do your magic here
}

const StravaStrategy = new OAuth2Strategy(strava0AuthConfig, stravaCallback)
StravaStrategy.userProfile = fetchStravaProfile
passport.use("strava", StravaStrategy)

and then in your routers

router.get("/strava", passport.authenticate("strava"))

router.get("/strava/redirect", passport.authenticate("strava", { failureRedirect: process.env["WEB_SERVER"] }), (req, res) => {
    res.redirect(process.env["WEB_SERVER"] + "/user")
})

Hopefully this helps someone