 <p>By making the assumption that express middleware handling is not broken: Why don't you try to write an injection middleware that is responsible to inject the desired session data and place the injection middleware before your middleware function you want to test?</p> <p>With this approach you don't test client code directly but isolate the injection in your injection middleware.</p>