diff --git a/server/middleware/auth.ts b/server/middleware/auth.ts
index 4dd3b74..f925983 100644
--- a/server/middleware/auth.ts
+++ b/server/middleware/auth.ts
@@ -6,18 +6,16 @@ export interface AuthenticatedRequest extends Request {
 }
 
 export const authMiddleware = async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
-  if (!req.user) {
+  if (!req.isAuthenticated || !req.isAuthenticated()) {
     return res.status(401).json({ error: 'Authentication required' });
   }
   
   try {
-    // Refresh user data from database
-    const user = await storage.getUser(req.user.id);
-    if (!user) {
+    // User is already available from Passport session
+    if (!req.user) {
       return res.status(401).json({ error: 'User not found' });
     }
     
-    req.user = user;
     next();
   } catch (error) {
     console.error('Auth middleware error:', error);
diff --git a/server/routes.ts b/server/routes.ts
index 0b0ad71..395f192 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -76,6 +76,22 @@ passport.deserializeUser(async (id: number, done) => {
 });
 
 export async function registerRoutes(app: Express): Promise<Server> {
+  // Session configuration
+  app.use(session({
+    secret: process.env.SESSION_SECRET || 'menassist-secret-key-2025',
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      secure: false, // Set to true in production with HTTPS
+      httpOnly: true,
+      maxAge: 24 * 60 * 60 * 1000 // 24 hours
+    }
+  }));
+
+  // Initialize Passport
+  app.use(passport.initialize());
+  app.use(passport.session());
+
   // Apply security middleware
   app.use(securityMiddleware);
   app.use(compressionMiddleware);