title: How is the express req.session object persisted?
body: <p>I'm very new to learning Node and Express, and I'm still trying to wrap my head around the code flow with express. Suppose we have code that looks like this in a session.js:</p>
  
  <pre><code>app.post('/session', notLoggedIn, function(req, res) {
      User.findOne({
          username: req.body.username, 
          password: req.body.password
      }, function (err, user) {
          if (err) {
              return next(err);
          }
          if (user) {
              req.session.user = user;
              res.redirect('/users');
          } else {
              res.redirect('/session/new');
          }
      }); 
  });
  </code></pre>
  
  <p>Assuming the User is a required mongo schema. What I find strange is the session.user assignment:</p>
  
  <pre><code>req.session.user = user;
  </code></pre>
  
  <p>Since the req variable will be out of scope after the redirect, but we're obviously doing this to persist the user data, I'm left with figuring out which of the following scenarios describe what is happening. Either (A) the argument that's being assigned to the req parameter (when the callback is called) is stored/somewhere still on the stack, (B) the session is stored/on the stack and being assigned to a new req object before it's passed in to the callback, or (C) the same as B, but on the user field (seems unlikely and maybe contrived on my part).</p>