@lorb/passport

Modern, maintained fork of Passport.js -- TypeScript-first, zero dependencies, ESM + CJS.

Why this fork

Passport.js is effectively unmaintained. Open issues pile up, PRs go unreviewed, and the codebase is stuck in CommonJS-era JavaScript. This fork rewrites everything in TypeScript, ships ESM and CJS dual builds, drops all runtime dependencies, and fixes long-standing bugs -- while remaining a drop-in replacement.

Install

npm install @lorb/passport

Drop-in replacement

// Before
import passport from 'passport';

// After
import passport from '@lorb/passport';

Everything else stays the same. Your existing strategies (passport-local, passport-google-oauth20, etc.) work without changes.

Usage

import passport from '@lorb/passport';
import express from 'express';
import session from 'express-session';

const app = express();

app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: false }));
app.use(passport.initialize());
app.use(passport.session());

passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser((id, done) => {
  User.findById(id).then(user => done(null, user));
});

// Use any passport-* strategy as before
passport.use(new LocalStrategy((username, password, done) => {
  // your auth logic
}));

app.post('/login', passport.authenticate('local', {
  successRedirect: '/',
  failureRedirect: '/login',
}));

What changed from original passport

• Full TypeScript rewrite with exported types
• Zero runtime dependencies
• ESM + CJS dual package (proper exports field)
• Session restore bugs fixed
• Works with Express 4 and 5
• Node.js >= 18

API

Same as Passport.js -- passport.use(), passport.authenticate(), passport.serializeUser(), passport.deserializeUser(), passport.initialize(), passport.session().

Additionally exports: Authenticator, SessionStrategy, SessionManager, AuthenticationError, and all TypeScript types.

License

MIT -- Lorb.studio