I would look at the store you use for session data if you do not use cookies to actually store all session data, not just the session ID.
There may be access to the list of sessions, no matter where the session data is stored, but I think not. But I may be mistaken.
An express API session is described here if you could not find it (I spent a lot of time to find out that many Express objects actually connect objects and are documented there). But you probably knew that ...
esp
source share