Failed to serialize user into session Authentication Origin: Application & API Last updated 15 Oct 2026

Passport.js: Error: Failed to serialize user into session

Passport logged a user in but there’s no serializeUser function (or it didn’t call done), so the session can’t store the user.

Exact message you may see Failed to serialize user into sessionFailed to deserialize user out of session
Explore the map of this error Full error map →
Seen on: REST API

Meaning

Session-based Passport setups need passport.serializeUser and deserializeUser, and the session middleware before passport.session(). Calling done with undefined also fails.

Common causes

  • serializeUser not defined
  • done() not called / called with undefined id
  • Middleware order wrong (session after passport)
  • Using sessions when session: false was intended

⚡ Quick fix

  1. Define serializeUser/deserializeUser
  2. Order: express-session → passport.initialize() → passport.session()
  3. Use { session: false } for token-based APIs

Detailed fix by platform

JavaScript

  1. javascript
    passport.serializeUser((user, done) => done(null, user.id));
passport.deserializeUser(async (id, done) => done(null, await User.findById(id)));

How to diagnose

  1. Functions — Defined?
  2. Middleware — Order
  3. Mode — Sessions or JWT?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

ExpiredToken — AWS: ExpiredToken — The security token included in the request is expired (AWS)ExpiredTokenIllegal arguments: undefined, string — bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required (Authentication)Illegal arguments: un…invalid csrf token — ForbiddenError: invalid csrf token (EBADCSRFTOKEN) (Authentication)invalid csrf tokenlogin_required — OIDC Error: login_required / interaction_required / consent_required (silent authentication failed) (Authentication)login_requiredSameSite cookie blocked — This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure (Authentication)SameSite cookie block…Session has not been configured — InvalidOperationException: Session has not been configured for this application or request (.NET)Session has not been …session_start() — Warning: session_start(): Session cannot be started after headers have already been sent (PHP)session_start()state mismatch — OAuth callback error: state mismatch / Unable to verify authorization request state / State cookie was missing (Authentication)state mismatchFailed to…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.