title: Express.js / Passport.js: Where is req.user stored?
body: <p>I am developing a web application that is going to be deployed to Heroku.</p>
  
  <p>I have chosen to go with a Node.js stack as I am fed up with "traditional" web frameworks. I am designing the app on Express.js. I've found it very productive and intuitive compared to e.g. Django or Grails.</p>
  
  <p>So the web app is going to have features for both guests and authenticated users. And as the app is deployed to Heroku, which is a cloud platform service, the application cannot have any internal state stored inside the server because of Heroku's load balancers and practices in general. And the fact is that having internal state is also bad design in a distributed environment.</p>
  
  <p>My local development setup has a Redis instance (for storing sessions) and a MongoDB instance (for storing user data, e.g. Facebook user details). I am using Passport.js and <em>passport-facebook</em> to handle authentications. Currently, I have only Facebook authentication implemented which works fine at least locally.</p>
  
  <p>The problem is that I am not sure nor have I read anywhere about how Express / Passport magically populates the <em>req.user</em> object. I'm a bit suspicious about that and it feels like that is stored in server's memory.</p>
  
  <pre><code>passport.serializeUser(function(user, done) {
      console.log(
          "This outputs a complete" +
          "User Profile object when the user logs in.", 
          user);
      done(null, user);
  });
  
  passport.deserializeUser(function(obj, done) {
      console.log(
          "And this too, but I'm afraid that" +
          "obj comes from memory.", 
          obj);
      done(null, obj);
  });
  </code></pre>
  
  <p><a href="http://passportjs.org/guide/profile/" rel="noreferrer" title="User Profile">Passport.js documentation</a> does not tell very well about this one. My guess is that serializeUser() gets the user from Facebook, but deserializeUser() takes it from memory? </p>
  
  <p>If so, would it be a solution to dump the raw user data into the Mongo database in serializeUser() and then get it from there in deserializeUser()?</p>