Fix Error: req.session is undefined — session middleware not initialized in Express

This error occurs when you access req.session before the express-session middleware has been registered, or when the session store fails to connect. Fix it by ensuring express-session is registered before your routes and that the session store connection is healthy.

Reading the Stack Trace

Here's what each line means:

• at authenticateUser (/app/src/middleware/auth.js:8:24): The auth middleware tries to read req.session.userId at line 8, but req.session is undefined because session middleware was not initialized.
• at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5): Express is executing the middleware layer chain; the session middleware was either missing or registered after this route.
• at expressInit (/app/node_modules/express/lib/middleware/init.js:40:5): Express initialization middleware ran, but session middleware was not in the chain before the auth middleware.

Common Causes

const express = require('express');
const session = require('express-session');
const app = express();

// Routes registered before session middleware
app.get('/dashboard', (req, res) => {
  res.json({ user: req.session.userId });
});

app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: false }));

const session = require('express-session');
const RedisStore = require('connect-redis').default;
const { createClient } = require('redis');

const redisClient = createClient({ url: 'redis://wrong-host:6379' });
// redisClient.connect() never called or fails silently

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: 'keyboard cat'
}));

// package.json does not include express-session
const session = require('express-session'); // throws MODULE_NOT_FOUND

The Fix

Move the express-session middleware registration above all route definitions so that req.session is populated before any route handler accesses it. Also add a guard to handle unauthenticated requests gracefully.

const express = require('express');
const session = require('express-session');
const app = express();

app.get('/dashboard', (req, res) => {
  res.json({ user: req.session.userId });
});

app.use(session({ secret: 'keyboard cat', resave: false, saveUninitialized: false }));

app.listen(3000);

const express = require('express');
const session = require('express-session');
const app = express();

// Session middleware BEFORE routes
app.use(session({
  secret: process.env.SESSION_SECRET || 'keyboard cat',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: process.env.NODE_ENV === 'production', maxAge: 86400000 }
}));

app.get('/dashboard', (req, res) => {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  res.json({ user: req.session.userId });
});

app.listen(3000);

Testing the Fix

const request = require('supertest');
const express = require('express');
const session = require('express-session');

function createApp() {
  const app = express();
  app.use(session({ secret: 'test-secret', resave: false, saveUninitialized: false }));
  app.get('/dashboard', (req, res) => {
    if (!req.session.userId) {
      return res.status(401).json({ error: 'Not authenticated' });
    }
    res.json({ user: req.session.userId });
  });
  return app;
}

describe('GET /dashboard', () => {
  it('returns 401 when session has no userId', async () => {
    const res = await request(createApp()).get('/dashboard');
    expect(res.status).toBe(401);
    expect(res.body.error).toBe('Not authenticated');
  });

  it('req.session is defined when middleware is registered', async () => {
    const res = await request(createApp()).get('/dashboard');
    expect(res.status).not.toBe(500);
  });
});

Run your tests:

npx jest --testPathPattern=session

Pushing Through CI/CD

git checkout -b fix/express-session-error,git add src/app.js src/__tests__/session.test.js,git commit -m "fix: register session middleware before routes",git push origin fix/express-session-error

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npx jest --coverage
      - run: npm run lint

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

npm install bugstack-sdk

const { initBugStack } = require('bugstack-sdk')

initBugStack({ apiKey: process.env.BUGSTACK_API_KEY })

Deploying the Fix (Manual Path)

1. Run the test suite locally to confirm session is available in route handlers.
2. Open a pull request with the middleware reorder.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main and verify session behavior in staging before promoting to production.

Frequently Asked Questions