hmm. How about using a different middleware for session verification only? Like I said before.. this won't require you to extract the

res

object at all from graphql.. only the

req

object - which you seem to be able to get,