How to add something to a session?

Question

Node.js

Unable to complete session. When authorizing, everything works fine, the session is saved in mysql.
But in the app.post("/addt" block, I need to somehow supplement the existing one, and for some reason the variable is not created here. How to be?

app.get("/",(request,response)=>{
  if(request.session.userId && request.session.userLogin){
    response.render('index');
  }else{
    response.render('auth');
  }
  console.log(request.session.tok);
});

app.post("/addt", (request,response)=>{
  request.session.tok = request.body.token;
});

app.post("/auth",(request,response)=>{
  user.findOne({where: {login: request.body.login}})
  .then(usr=>{
    if(usr.login == request.body.login && usr.password == request.body.password){
      request.session.userId = usr.id;
      request.session.userLogin = request.body.login;
      request.session.userPass = request.body.password;

      response.json({
        status: true
      })
    }else{
      response.json({
        status: false
      })
    }
  })
  .catch(err=>{
    response.json({
      status: false
    })

Answer 1

But in the app.post("/addt" block, I need to somehow supplement the existing one, and for some reason the variable is not created here. How to be?

You do not fully understand the essence of the issue. The session is set in request.seesion on every request to the server. In your case, most likely the user data is read from a mysql table. Thus

in the app.post("/addt" block, I need to supplement the existing

will not work

When authorizing, everything works fine, the session is saved in mysql.

in the block

app.post("/auth",(request,response)=>{
  user.findOne({where: {login: request.body.login}})
  .then(usr=>{

nothing will be saved, but on the contrary, user data is read from the user table to compare login and password

if(usr.login == request.body.login && usr.password == request.body.password){

Although the block of code above is working, it means that the password is stored in the database in clear text, user logins will be duplicated, xss attacks, etc. are possible. I hope this is part of a term paper, and not industrial code...

app.post("/addt", (request,response)=>{
  request.session.tok = request.body.token;  // что тут вы хотели сделать,  request.body.token - в table user записать ???
});

The block of code above is completely meaningless though. Here you have left your request unanswered. As a result, the server will ever return a timeout error.

Answer 2

Each request has its own req/res instance, which is removed when res.[end, json, render, etc] is called;
In your case, just store the token in the database. And at the beginning of the request, create middleware and take this data from the database.