To rephrase passport.js documents, Flash messages are combined with route redirection to provide or display status information to the user.
app.post('/login', passport.authenticate('local', { successRedirect: '/', failureRedirect: '/login', failureFlash: true }) );
You basically need them to tell the user that they either failed or got access to some resource.
The following are snippets presented in the docs:
In case of failure
passport.authenticate('local', { failureFlash: 'Invalid username or password.' });
In case of success
passport.authenticate('local', { successFlash: 'Welcome!' });
source share