title: How to properly use Passport.js?
body: <p>I am using :</p>
  
  <ul>
  <li>Node.js</li>
  <li>Express 4.0</li>
  <li>Passport.js</li>
  <li>Google OAuth 2 for Authentication</li>
  </ul>
  
  <p>For each user, I store in a MySQL DB (I don't have the choice regarding this technology) some info from his Google Profile (email etc...), access &amp; refresh tokens, and also additionnal info that the user provides when he registers on my app.</p>
  
  <p>I have seen different uses of passport.js, specifically regarding how that info is stored in session.</p>
  
  <ol>
  <li><p>On <a href="http://passportjs.org/guide/configure/" rel="nofollow">passport.js's configure
  page</a>, I don't really
  understand the point of the following block of code :</p>
  
  <pre><code>passport.deserializeUser(function(id, done) {
    User.findById(id, function(err, user) {
      done(err, user);
    });
  });
  </code></pre>
  
  <p>Basically, each time the user makes a request, or visits a page, there's a request to the DB and information is retrieved. What is the point ? It slows the app a lot. Shouldn't the info from the DB be retrieved when <code>serializeUser</code> is called (ie. when the info is stored in session) ?</p></li>
  <li><p>I have read that storing <strong>too much</strong> info in <code>session</code> can slow the
  app. What is "too much" ? How much will it slow the app ? Does
  someone know if there are tests somewhere ? My app's pages require a
  different set of data about my user (for example, the homepage will
  only need his name whereas the profile page will need everything,
  another page will need to know what cars he owns etc...). Should I
  store all that info in <code>session</code> when <code>passport.authenticate</code> checks
  if the user exists in the DB (thus limiting read-requests to the DB
  to approximately one), or only store in session his id and have my
  pages make additionnal requests to the DB when necessary ?</p></li>
  <li><p>Another issue I have : in the registration process, I first have the user log in on his
  Google Account, I store his profile's details <em>somewhere</em>, have him
  fill a form for additionnal info, and then I insert everything in
  the DB. The problem is I don't know how to properly store his Google
  Account details until they are inserted into the DB. For the moment,
  I store them in <code>session</code>, and then delete that when the insertion
  is successful. More specifically, when no existing user is found in
  my DB, I do, in my <code>passport.authenticate</code> callback:</p>
  
  <pre><code>return done(null,false,userInfo);
  </code></pre>
  
  <p>Thus, the user is not authenticated and I have 2 issues : I have to
  store that <code>userInfo</code> somewhere until the user is registered and I have
  to log him "manually" using <code>req.login()</code> after the registration is complete.</p>
  
  <p>Should I allow him to be authenticated as soon as he logs in on his
  Google Account ? Wouldn't that cause security issues for me if he
  does not complete his registration ?</p></li>
  <li>Lastly, I have read about using Reddis. Would that help me with
  these issues ?</li>
  </ol>
  
  <p>Thank you very much !</p>