Passport & JWT & Google/Facebook Strategy - How do I combine JWT and Google/Facebook Strategy?

I solved this in this way:

1. On Front-End (can be mobile app) I made login request to Google (or Facebook) and after the user selected his account and logged in I got back response that contained google auth token and basic user info.
2. Then I sent that google auth token to backend where my API sent one more request to the Google API to confirm that token. (See step 5)
3. After successful request comes you get basic user info and e-mail. At this point, you can assume that user login via Google is good since google check returned that it's okay.
4. Then you just signup or login user with that email and create that JWT token.
5. Return token to your client and just use it for future requests.

I hope it helps. I implemented this multiple times and it showed like a good solution.

Though there is good answer, I wanted to add more information with example.

• Passport's google/facebook strategy is session based, it stores user info in cookie which is not advisable. So we need to disable it first

To disable session we need modify our redirect router. For example if we have redirect path /google/redirect like following, we need to pass { session: false } object as parameter.

router.get('/google/redirect', passport.authenticate('google', { session: false }), (req, res)=> {
    console.log(":::::::::: user in the redirect", req.user);
    //GENERATE JWT TOKEN USING USER
    res.send(TOKEN);
})

So where does this user come from? This user comes from passport's callback function. In the previous snippet we have added passport.authenticate(....) This middlewire initiates passport's google-strategy's callback which deals with the user. For example

passport.use(
    new GoogleStrategy({
        callbackURL: '/google/redirect',
        clientID: YOUR_GOOGLE_CLIENT_ID
        clientSecret: YOUR_GOOGLE_SECRET_KEY
    }, 
    (accessToken, refreshToken, profile, done)=>{
        console.log('passport callback function fired');

        // FETCH USER FROM DB, IF DOESN'T EXIST CREATE ONE

        done(null, user);

    })
)

That's it. We have successfully combined JWT and Google/Facebook Strategy.