session: false doesn't work

[wzup]

Session: false is not working.
Your docs say it should be specified in options. But that's not true. It doesn't work that way.

passport.use(new LocalStrategy({
    usernameField: 'email',
    passwordField: 'passwd',
    session: false
  },
  function(username, password, done) {
    // ...
  }
));

Either change docs of modify the code.
Because it has to be like this, not in initial config

passport.authenticate('local', {session:false})

[marcellino-ornelas]

Any progress on this running into this same problem?

[TeodorKolev]

Same here

[ritlew]

Running into this issue as well, can this get some attention?

[TiruvedulaMithun]

The same problem here, it's causing 100s of unwanted sessions between backend APIs, please help! @jaredhanson

[gunhaxxor]

Same here. Looking in the source code I can't see anywhere where the session-option is actually used 🤔

passport-local/lib/strategy.js

Lines 42 to 56 in 4d9fbef

	function Strategy(options, verify) {
	if (typeof options == 'function') {
	verify = options;
	options = {};
	}
	if (!verify) { throw new TypeError('LocalStrategy requires a verify callback'); }
	this._usernameField = options.usernameField || 'username';
	this._passwordField = options.passwordField || 'password';
	passport.Strategy.call(this);
	this.name = 'local';
	this._verify = verify;
	this._passReqToCallback = options.passReqToCallback;
	}

[MarvinXu]

Same here. Looking in the source code I can't see anywhere where the session-option is actually used 🤔

passport-local/lib/strategy.js

Lines 42 to 56 in 4d9fbef

	function Strategy(options, verify) {
	if (typeof options == 'function') {
	verify = options;
	options = {};
	}
	if (!verify) { throw new TypeError('LocalStrategy requires a verify callback'); }
	this._usernameField = options.usernameField || 'username';
	this._passwordField = options.passwordField || 'password';
	passport.Strategy.call(this);
	this.name = 'local';
	this._verify = verify;
	this._passReqToCallback = options.passReqToCallback;
	}

Looks like a documentation error.

session: false option only works in passport.authenticate('local', { session: false })