Express: is it possible to bypass sessions for static files?

Question

I use the fairly simple Express + Mongoose + Passport + Connect-mongo setup and everything works fine. The only thing that puzzles me is that I see passport.unserializeUser , even called for static files, which - from my point of view of the application - is completely pointless.

I can understand that there are cases when you want static files to be serviced under some kind of authorization, but I am wondering how I could “skip” all the session middleware if I serve a static file.

(In a production environment, I could not use cookies for assets)

Answer 1

The second software is called in the order in which it was added. Just move static middleware very early in app.js

For instance:

 app.use(express.static(__dirname + "/public")); // any other middleware app.use(passport()); // or whatever your passport config looks like 

Answer 2

You can use static files from another domain that does not store cookies at all. It also means that you cannot perform any security checks before servicing these files.

This method is used by various sites such as StackOverflow, Facebook and LinkedIn.