See NextJS section -> session verification -> ssr method. Even if you are not using NextJS, you can do something similar

You mean this? https://supertokens.com/docs/thirdpartyemailpassword/nextjs/session-verification/in-ssr

Yes

Ok. So, you are suggesting to use

Session.getSession

here?

Yes

I wanted to have similar workflow as `verifySession`(setting req.session object by middleware). So in that case, here's what I'll do. 1. I'll create my own middleware

authenticate()

2. In this middleware, I will use

Session.getSession

to verify the session and then I'd add the session info in req.session object. Then at the route handler side, I can simply

req.session

to see if the session is valid or expiered.\

Yea. And then I case the getSession throws a try refresh token exception, you can return the html page you wanted to

I was just writing that. If I find the error while verifying session to be

Session.Error.TRY_REFRESH_TOKEN

, I will start refresh token process (I still needs to learn about that)

Yea.. well.. u should only use this for server side rendered routes

I'm handling both API and html from one express app. Vanilla js. Ejs for templating.

Ok. So for APIs, you should use verifySession and for server side rendered routes, you can use your custom middleware

I am using same path for APIs and server side rendered routes. If the requested content-type is json, I return json otherwise the server side rendered html.

Okay