// app.js
app.use(session({
  name: 'mysite',
  secret: 'mysite',
  cookie: 2592000000,
  store: new MongoStore({
    url: 'mongodb://localhost:27017/ad_system'
  })
}));

// captcha
exports.captcha = (req, res, next) => {
  var ary = ccap.get();
  var text = ary[0];
  var buf = ary[1];
  req.session.captcha = text;
  res.end(buf);
};

// login 判断captcha部分代码
exports.login = (req, res, next) => {
  var json = {},
      username = req.body.username,
      password = req.body.password,
      captcha = req.body.captcha,
      rememberMe = req.body.rememberMe;

  if (username === '' || password === '') {
    json = {
      status: 0,
      msg: '请输入用户名和密码'
    };
    return res.json(json);
  }
  console.log(req.session.captcha); // undefined
  if (req.session.captcha !== captcha) {
    json = {
      status: -1,
      msg: '请输入正确的验证码'
    }
    return res.json(json);
  }
  User.findOneAsync({
    username,
    password: crypts.sha256(password)
  })
  .then((result) => {
    if (result) {
      var id = result._id,
          remember_me = req.body.remember_me ? 2592000000 : 86400000,
          token = crypts.sha256(id + '|' + username)
      res.cookie('user', token, { maxAge: remember_me });
      res.cookie('userid', token, { maxAge: remember_me });
      res.cookie('username', token, { maxAge: remember_me });
      req.session.user = username;
      req.session.isLogin = true;
      json = {
        status: 1,
        msg: '登录成功',
        token: token
      }
    } else {
      json = {
        status: 0,
        msg: '用户名密码错误'
      }
    }
    res.json(json)
  }).catch(err => {
    res.json({
      status: 0,
      msg: err.toString()
    })
  })
};

// routes
router.post('/login', (req, res, next) => {
  user.login(req, res, next);
});

router.get('/captcha', (req, res, next) => {
  user.captcha(req, res, next);
});

为什么req.session.captcha是undefined？