title: Passport token auth *without* database session
body: <p>I am looking for a way to use the Twitter strategy for Passport.js without using a sessions collection/table in a database.
  The reason for this is we save all that data in the sessions collection which can get quite large and we save a database roundtrip whenever a user makes a request because we dont have to go to the DB each time to fetch the session data.</p>
  
  <p>Anyway, we should be able to use a token (JSON Web Token) to authenticate a user, just how this great article describes:</p>
  
  <p><a href="https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens">https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens</a></p>
  
  <p>But I am confused why there isn't an easy way to just do this with Passport? (The article does everything without Passport - but surely Passport has this covered?).</p>
  
  <p>Perhaps I am overthinking this and the way to do that is just to omit the calls that I have in Express to use the DB session and then Passport is already smart enough to handle the the JWTs? Somehow I doubt that.</p>
  
  <p>For example, surely it isn't enough to just comment out this code in my Express server:</p>
  
  <pre><code>//app.use(expressSession({
  //    secret: 'arrete_x_paulette',
  //    store: new MongoStore({mongooseConnection: mongoose.connection}),
  //    saveUninitialized: true,
  //    resave: true,
  //    cookie: {
  //        secure: false,
  //        maxage: 6000000
  //    },
  //    proxy: false
  //}));
  </code></pre>
  
  <p>and</p>
  
  <pre><code>//app.use(passport.session());
  </code></pre>
  
  <p>So what is enough, using Passport?</p>
  
  <p><strong><em>Why would anyone ever use sessions stored in the DB over using JWT based auth?</em></strong></p>