Is it okay to store a $node object as a $_SESSION variable My contrib module currently stores a $node object temporarily in the variable table, and stores the nid for that $node in the $_SESSION variable so that the $node can be retrieved from the variable table at a later point.

Would it be okay to store the $node directly in the $_SESSION variable? Or would there perhaps be a performance of security impact?

If it is okay to store a $node object in the $_SESSION variable, do I need to serialize it first?
I think you want the ctools object cache API here, this is what views uses to store edits to a view until they are saved and is what Drupal 8 uses for node preview. In D8 it's called user temp store.