mern-passport | boilerplate example of using passport | Authentication library

From a glance at the full source code, it doesn't look like you've set withCredentials: true in the Axios requests you're making to your backend. Passport, at a high level, works like this:

1. Your /login and /register routes send a cookie back in their response. This is stored by your browser for future requests to identify the session (which, by your comment, seem to be working correctly).

2. When you want to make an authenticated request to your backend, Axios has to explicitly send the cookie back in the request if it's cross-origin — that's where withCredentials comes in. Without it, Axios isn't sending the cookie with the request to identify the session.

By setting withCredentials: true, Axios should send the cookie back in the requests and Passport & express-session will use it to identify the user.