https://github.com/koajs/session/blob/6.1.0/lib/context.js#L38

On the linked line from the file above, it's either create new session or initialized from cookie when retrieving a session i.e ctx.session.something.

Why does it not support initializing from external as well (on this specific part of the code. external init is being called somewhere else)?

Is this intended?

An example where this might happen is the following:

const response = request(koaApp).post('/give-me-session');
const cookie = extractCookieFromResponse(response);
const websocket = new WebSocket('ws://<address:port>/ws/use-my-session');

// Websocket Handler
function websocketHandler(req) {
  const ctx = koaApp.createContext(req);
  const authenticated = ctx.session.userId;
}

If I were to use cookies, this would work because of the highlighted line above but otherwise it's going to be a new session.

Is this intended? Is this wrong?

Workaround would be:

async function websocketHandler(req) {
  const ctx = koaApp.createContext(req);
  const sessionId = ctx.cookies.get('koa.sess');
  const sessionData = await koaSessionStore.get(sessionId);
}