Consider excluding options from authenticate middleware

[alexandradeas]

This issue has arisen mostly out of incorrect implementation anyway but thought I would bring it to attention.

It's possible to inadvertently require authentication on a call to OPTIONS with:

app.use(passport.authenticate("jwt", { session: false })

It's worth pointing out that nowhere in the documentation is the method used in this way.

This can easily be worked around by wrapping the middleware as

app.use((req, res, next) => {
  if (req.method !== "OPTIONS") {
    passport.authenticate("jwt", { session: false });
  }
  next();
});

I'm wondering if it's worth dropping this validation down into passport itself so that it will never require authentication on a call with the OPTIONS method as request headers should not be included according to the standard: https://www.w3.org/TR/cors/#preflight-request

[GlennMatthys]

Instead of app.use(), use app.get()/app.post()/... Makes more sense than to hard code this into passport.js

[Ravichandra-C]

Shouldn't this be mentioned in the documentation?