> How Passport.js handles authentication in Node.js apps: GDPR points for OAuth strategies, session cookies and data shared with third party login providers. > > Canonical: https://www.flowconsent.com/en/services/security/passport-js Security # Passport.js Essential · [Official website](https://www.passportjs.org) Passport.js is an open source authentication middleware for Node.js, used in tens of thousands of applications to handle login flows. It supports over 500 authentication strategies including local username/password, OAuth (Google, Facebook, GitHub, Microsoft), SAML, OpenID Connect, JWT and many more. Passport itself is just a library running on the publisher server: it does not transfer data to any vendor, does not set cookies on its own (session cookies come from express-session) and is not a processor under GDPR. Compliance considerations focus on the strategies the publisher chooses. [Block Passport.js until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 1 - Third-party domains 2 - Servers Customer infrastructure (open source library, Passport.js does not host data) Overview ## What does Passport.js do? ## **What Passport.js is and how it works** Passport.js is an open source authentication middleware for Node.js, originally created by Jared Hanson and now maintained by a small community. It is bundled in or referenced by most major Node.js web frameworks (Express, Fastify wrappers, NestJS Passport module). Its strength is the strategy pattern: each authentication mechanism is implemented as a plugin (passport-local, passport-google-oauth20, passport-saml, passport-jwt and so on), and the application code stays the same regardless of which providers are enabled. ## **Data and cookies Passport.js handles** Passport.js does not set cookies on its own. Session cookies are managed by the session middleware (express-session, fastify-session or similar) and stored either client side (signed cookie sessions) or server side (Redis, Memcached, database). Passport processes the data that the chosen strategy hands back, which can include OAuth tokens, the user profile (name, email, sometimes phone, avatar URL), the provider user ID and any custom scopes requested. The library does not phone home or share data with any third party. ## **GDPR implications** Because Passport.js is a library running on the publisher infrastructure, the publisher is the sole controller for the authentication processing. There is no Passport.js Inc. to sign a DPA with. The compliance picture is built around the strategies you enable. OAuth with Google, Facebook, GitHub or Microsoft means user data is shared with those providers in the US, requiring documentation of the transfer mechanism. SAML with an internal corporate IdP keeps everything within the controller infrastructure. Local username/password sessions need standard security controls (hashed passwords with bcrypt or argon2, rate limiting, MFA where appropriate). ## **Consent and lawful basis** Authentication is normally based on contract performance (Art. 6(1)(b) GDPR) since the user is requesting access to the service. The session cookie itself is strictly necessary for the requested service and does not need an opt in under the ePrivacy Directive. Consent is only needed if you collect optional profile data (newsletter subscription, marketing preferences) during signup, or if you use non strictly necessary cookies in the same flow. ## **Strategy by strategy assessment** Local: no third party; ensure strong password hashing and breach defences. OAuth Google: user data shared with Google LLC (US), Standard Contractual Clauses apply, document in record of processing activities. OAuth GitHub: data shared with GitHub Inc. (US, owned by Microsoft), same considerations. OAuth Apple: privacy oriented, Apple acts as relay. SAML: depends on the IdP location, normally enterprise internal. OpenID Connect: depends on the IdP. JWT: stateless tokens; the publisher controls the data inside the token. ## **Practical compliance steps** Minimise the OAuth scope to what you really need (no profile photo or birthday unless used), hash passwords with bcrypt or argon2 in the local strategy, set secure HttpOnly SameSite cookies for sessions, document each strategy in your record of processing activities including the data shared and the transfer mechanism, run a Transfer Impact Assessment for any non EU OAuth provider, and disable strategies you do not use to reduce the attack surface and the privacy footprint. Compliance ## Passport.js and the GDPR - Legal basis Contract performance (Art. 6(1)(b) GDPR) for user authentication; legitimate interest (Art. 6(1)(f)) for security telemetry - Risk level low - Applicable regulations GDPR, ePrivacy Directive (for session cookies) ### Impact assessment (DPIA) Passport.js itself processes only the data the publisher passes to it. The compliance picture depends on the strategies used: local username/password processes credentials on the publisher server (low transfer risk); OAuth strategies (Google, Facebook, GitHub, Microsoft, Apple) transfer user identifiers and tokens to the relevant identity provider; SAML strategies depend on the SAML IdP location. Key considerations: (1) for OAuth with US providers, document the transfer mechanism (SCCs, Data Privacy Framework) in your record of processing activities; (2) the scope of data requested from OAuth providers should be minimised to what is necessary; (3) session cookies set by express-session are subject to ePrivacy if used outside strict necessity; (4) some strategies fetch the entire user profile including phone, address, photo, which may be excessive. ### Sample text for your banner > We use Passport.js, an open source authentication library, to handle login. We do not share data with the Passport.js maintainers. When you sign in with a third party provider (Google, GitHub, etc.), your data is shared with that provider under their terms. Session cookies are required to keep you logged in and are set after you sign in. Cookies and trackers ## What Passport.js sets and contacts - Tracking method Server side authentication middleware (Node.js library, no cookies of its own) - Server location Customer infrastructure (open source library, Passport.js does not host data) - Cookieless mode available Yes ### Cookies set (1) | Name | Type | Duration | Purpose | | ----------- | ------------------ | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | connect.sid | Strictly Necessary | Session or configured | Default session cookie set by express-session (the typical companion of Passport.js). Contains a signed session identifier and is used to maintain authenticated state across requests. Lifetime is configured by the publisher. | ### Third-party domains contacted (2) - `publisher domain (Passport.js is a library, not a third party host)` - `depends on OAuth strategies enabled (e.g. accounts.google.com, github.com, facebook.com)` Questions ## Frequently asked questions about Passport.js Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Passport.js set cookies? Passport.js does not set cookies on its own. Session cookies are managed by the session middleware (typically express-session in Express apps), which stores either a signed session ID client side or the full session server side. The cookie set is the publisher's session cookie, on the publisher's own domain. ### Is consent required to use Passport.js? For the authentication itself, no. Authentication is based on contract performance (Art. 6(1)(b) GDPR) and the session cookie is strictly necessary. Consent only enters the picture if you collect optional profile data during signup, use marketing cookies in the same flow, or use OAuth providers that require their own consent (e.g. Sign in with Facebook). ### What is the legal basis for processing data with Passport.js? Contract performance (Art. 6(1)(b) GDPR) is the standard basis for authentication. Legitimate interest (Art. 6(1)(f)) can apply for security telemetry (failed login attempts, suspicious IP tracking). Consent is needed for OAuth providers that act as joint controllers for advertising purposes. ### Does Passport.js transfer data to the United States? Passport.js itself does not transfer data anywhere; it is an open source library that runs on your server. Transfers depend on the strategies you enable: OAuth with Google, Facebook, GitHub or Microsoft transfers user data to those providers in the US, requiring SCCs and Data Privacy Framework documentation. ### Do I need a DPIA for Passport.js? Passport.js alone does not trigger a DPIA. A DPIA may be needed if the broader processing it enables is high risk (large scale authentication, sensitive sector, employee monitoring). For most consumer login flows, a documented assessment is sufficient. ### How do I implement Passport.js in a GDPR compliant way? Use the local strategy with strong password hashing (bcrypt or argon2), set HttpOnly Secure SameSite session cookies, minimise OAuth scopes to what you really need, disable unused strategies, document each strategy in your record of processing activities, run a Transfer Impact Assessment for non EU OAuth providers, and offer users a clear way to delete their account. ### What are alternatives to Passport.js? Other Node.js auth libraries: NextAuth.js (now Auth.js, very popular in Next.js), Lucia Auth, Better-Auth, Iron Session and Clerk SDK (hosted). For PHP, Symfony Security and Laravel Sanctum/Passport. For Python, django-allauth or FastAPI Users. The choice depends on framework and on whether you want a hosted service or a library. ### How should my privacy notice describe Passport.js? Passport.js itself does not need to be named in a cookie banner (no first party tracking). However, your privacy notice should describe the authentication strategies you offer, the data shared with each OAuth provider (with name, link to their privacy policy, transfer mechanism if outside EU), and how session cookies work. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [ip-api](https://www.flowconsent.com/en/services/security/ip-api) [ip-api is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. ip-api supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, ip-api helps create unified digital ecosystems that drive efficiency.](https://www.flowconsent.com/en/services/security/ip-api) [Essential](https://www.flowconsent.com/en/services/security/ip-api) · ### [Qualva](https://www.flowconsent.com/en/services/security/qualva) [Qualva is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Qualva supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Qualva ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/qualva) [Essential](https://www.flowconsent.com/en/services/security/qualva) · ### [Negate](https://www.flowconsent.com/en/services/security/negate) [Negate is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Negate supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Negate ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/negate) [Essential](https://www.flowconsent.com/en/services/security/negate) · ### [Magic Labs](https://www.flowconsent.com/en/services/security/magiclabs) [MagicLabs is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. MagicLabs supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, MagicLabs enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/magiclabs) [Preferences](https://www.flowconsent.com/en/services/security/magiclabs) · ### [ipbase](https://www.flowconsent.com/en/services/security/ipbase) [ipbase is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ipbase integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ipbase helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/ipbase) [Essential](https://www.flowconsent.com/en/services/security/ipbase) · ### [IPInfoDB](https://www.flowconsent.com/en/services/security/ipinfodb) [IPInfoDB is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. IPInfoDB supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, IPInfoDB ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/ipinfodb) [Essential](https://www.flowconsent.com/en/services/security/ipinfodb) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)