I'd like to use MS OAuth in my website made with Express.js.

In my plan, things would be like this:

1. Client visits localhost/register/.
   At this point, since I set saveUninitialized of SqliteStore to true, session data should be created.
2. Client clicks 'Login with MS' button.
   It will redirect client to MS login screen, and back to localhost/register/msauth/?code=blahblah.
3. Server will get code part from the URL, and store it as msauth in session(req.session.msauth), then redirect client to localhost/register.
   At this point, the session data have msauth as string.
4. Since there is msauth in session data, when user 'redirected' to localhost/register/, Server will get msauth from session data and pass it with other options.
   I use pug as 'template engine', I can access msauth in .pug and do something with it. Currently, since this is development stage, I just show the auth code to website.

So, when client visits localhost/register/, there would be two case of whether msauth is present or not.

This is my current code:

// routes/register.js
...
router.get('/', function (req, res) {
  let options = default_options; // Don't care about default_options, it's just predefined options object.
  if (res.sessions === undefined) {
    console.log('\x1b[36m%s\x1b[0m', 'session is undefined');
    options['MSAuthCode'] = null;
    res.render('register', options);
  } else {
    console.log('\x1b[36m%s\x1b[0m', 'session is valid');
    console.log(res.sessions);
    if ('msauth' in res.sessions) {
      options['MSAuthCode'] = res.sessions.msauth;
      console.log('msauth is ' + options.MSAuthCode);
    }
    res.render('register', options);
  }
});

router.get('/msauth/', function (req, res) {
  console.log('\x1b[36m%s\x1b[0m', req.query.code);
  req.session.msauth = req.query.code;
  res.redirect('/');
});
...

I expected when I visit localhost/register/msauth/?code=1000 after visiting localhost/register, it would not create new session and save 1000 to msauth in session data.

But it seems that it just creates new session. 'session is undefined' is printed on console at every refresh. So I have two session in Sqlite3 DB. One is session data without msauth, and another is with msauth. This should not happen in my 'theory'...

I don't get what is wrong with my code.