Express: is it possible to bypass sessions for static files?

express, javascript, node.js, passport.js

Solution

Middleware is called upon in the order it was added. Just move the static middleware to be very early in your `app.js`.

For example:

app.use(express.static(__dirname + "/public"));
// any other middleware
app.use(passport()); // or whatever your passport config looks like

Problem

I'm using a quite straightforward setup of Express + Mongoose + Passport + Connect-mongo, and everything works fine. The only thing that is puzzling me, is that I can see the `passport.unserializeUser` called even for static files, which is - from my application point of view - absolutely pointless. I can understand that there are cases where you want the static files to be served under some sort of authorization as well, but I wonder how I could "skip" the whole session middleware in case I'm serving a static file. (In a production environment I could not use cookies for assets)

Original source