Only a piece of cookie (as a string of char) is stored on client.
Everything else will be stored on Server.
Therefore, every time a client send its cookie (passport) to server, server will retrieve
corresponding data (session).
This data can be stored on RAM or pesisted (Redis).

Ex:

req.session.uid

(Server will use the code sent by client (cookies string) to get corresponding
session on stored on the Server)