Cause from a typed point of view, req.session can be undefined if you pass sessionRequired: false when calling verifySession.