It would end the req / resp cycle. But you can use

verifySession({sessionRequired: false})

to make it call the next middleware even if a session doesn't exist. In this case,

req.session

will be

undefined

.