Skookum/passport — comment on commit 3751d2917d08eb64a6e04f2f68f782e3ba8fd98b
File:  line 0
By jaredhanson:

Glad your linking Passport! Thanks for the ping.

- Re: Facebook permissions (aka OAuth 2.0 scopes):

I've got a patch waiting in the wings to Passport-OAuth, which will accept options from the authenticate call. I'm hoping to apply it tonight. When ready, you'll be able to request permissions as follows:

passport.authenticate('facebook', { scope: 'email' })

Or, if you need multiple permissions:

passport.authenticate('facebook', { scope: ['user_status', 'user_photos'] })

- Re: User serialization

This is really an application-specific issue that is hard to generalize. That said, here's a (hopefully good) explanation:

When a user logs in initially, a property `req.user` is set on the request. This value of this property is whatever the Strategy's `verify` callback supplies to `done`. Specifically, in the Facebook example, it is the `profile` of the Facebook user, which in turn has a `profile.id`, `profile.displayName`, etc.

If the user takes some action on your site, say posting a comment, you'll want to associate that with the user somehow. Usually, this is accomplished by tying the comment to the user via the `user.id`. If you only use Facebook authentication on your site, then the `user.id` will correspond to user's Facebook ID. This is fine, but has some tradeoffs.

For example, say the user came to your site, and wanted to sign in with either their Facebook account *or* their Twitter account. They want to see all their comments, regardless of which sign-in method they used when they left them. In this case, you'll want to have your own user-record (with a user ID that is specific to your site), that is linked to both a Facebook and Twitter account. In this case, you'll want to associate comments with a site-specific user ID, and use that to restore login sessions.

There's more than one way to go about this, and using Facebook only is fine too. I left the notes in the example code to encourage people to think about their application's needs, in hopes that they wouldn't just copy and paste and find out after-the-fact that the example code is example code for a reason.

Hopefully that helps. Let me know if you've got any other questions.

I'll post an update here when the update is available with scope support.

Jared