Difference between Express sessions and PassportJS
<p>I am looking at using express-session to store access tokens for users authenticated against an OAuth 2 provider, and providing the client application with a securely signed cookie.</p>

<p>From what I understand, I can then retrieve the token associated with the cookie in subsequent requests from a session store server side, e.g  mongodb, which I can then use in say a bearer Authorization header in requests to separate end point using Express routes.</p>

<p>I have come across PassportJS and am trying to figure out whether I need to use it in my setup.</p>

<p>Currently I am handling login POST requests in my express app and then making an access token request using a resource owner password credentials grant type request flow. This is working fine and I am receiving back an access token along with a refresh token and expiry time from the provider.</p>

<p>From what I can tell, PassportJS offers authentication strategies for all sorts of providers, but I am not so sure it will support the grant type being used in my case. Plus I'm already doing the work of requesting and receiving the token, so not sure how much benefit PassportJS would be for me here.</p>

<p>From reading the express-session docs, I think this will give me all I need, plus I can set the cookie expiry based on the token expiry time I get back from the api gateway.</p>

<p>I think PassportJS sits above express sessions, and simply accesses the express generated session, is that correct?</p>