I\'m trying to do this since a lot of days but all my tests fails...
Users on my platform connect them by using passportjs strategies (paypal, facebook, google...).<
For 'serializeUser' you are returning the entire user... which will serialize the entire object and put it inside the cookie used to track sessions. That serialization only happens one time (when the session is established). When the next request comes in, it always deserializes that exact same user object you stored originally, which doesn't have any updates you made to it. That's why logging out and logging back in works, because it retrieves the edited user from your database (I assume), and recreates the session tracking cookie.
To confirm this answer, put a breakpoint on 'serializeUser', and notice that it is only hit when you login.