title: What exactly does serialize and deseralize do in sessions with passport and express?
body: <p>I have only the haziest notion about what sessions do, and <a href="http://passportjs.org/guide/configure/" rel="noreferrer">the official documentation does not help much</a>, since it assumes I know what sessions are and therefore also know why users need to be serialized and deserialized.  </p>
  
  <p>Here's what I think I know:  a session is like a post-it note stuck on the server's refrigerator that says "User bob is cool. Let him in." Every time a new request comes from bob, the server checks the post-it node and and says, "Yep. Bob's still cool."  </p>
  
  <p>So serialization is writing the post-it note, and deserialization is taking it down.  here's what I don't understand:  how does this code write a post-it node, what is 'done' doing? </p>
  
  <pre><code>passport.serializeUser(function(user, done) {
    done(null, user.id);
  });
  </code></pre>
  
  <p>And how does the following code throw away the post-it note?  findByID accesses the array where I store my users.  Why does that need to be accessed if the 'post-it-note' is just going to be thrown away?</p>
  
  <pre><code>passport.deserializeUser(function(id, done) {
    findById(id, function (err, user) {
      done(err, user);
    });
  });
  </code></pre>
  
  <p>What, exactly, is the flow here? </p>
  
  <p>The rest of the code for these examples is <a href="https://github.com/jaredhanson/passport-local/blob/master/examples/express3-no-connect-flash/app.js" rel="noreferrer">here</a></p>