[deepakganesh78]

Fixes #935

Reproduction

On current master, a request that calls req.session.regenerate(), mutates the new session, and then calls req.session.save() writes the same regenerated session twice. A minimal supertest reproduction counted MemoryStore#set calls and showed total saves after response: 2.

Root cause

regenerate() replaces req.session with a new Session, but the middleware only wrapped the original session's methods. As a result, a manual save() on the regenerated session did not update the request's saved-session tracking hash, so the response finalizer treated it as unsaved and wrote it again.

Fix

Wrap regenerate() like reload() so the replacement session gets the middleware method wrappers. Track the explicitly saved session id in a separate savedId closure variable alongside savedHash, and use that pair only for isSaved().

Cookie-setting and modification semantics are unchanged: originalId is not mutated by save(), so session id rotation still makes isModified() true and still emits Set-Cookie for the new id even when the regenerated session has no data changes.

Compatibility / security notes

This is a conservative behavior fix: explicit session regeneration and saving still persists and sends the new session cookie, but avoids an extra store write that could overwrite concurrent updates. No dependencies or public API are changed.

Validation

• Original regression test fails without the fix: 0 passing, 1 failing, with 2 !== 1 store writes.
• Added no-data-change regression test fails under the first version of this fix: 0 passing, 1 failing, missing the expected Set-Cookie header.
• Targeted regenerate/save tests pass with this rework: 2 passing.
• Full suite via Git Bash on Windows: 175 passing (3s).
• npm run lint: passed.
• Direct npm test on Windows fails before running tests because npm/cmd cannot execute ./test/support/gencert.sh ('.' is not recognized...); reran the same script/test command through Git Bash with MSYS_NO_PATHCONV=1 successfully.

[kilisamemarisaaa]

I found one API compatibility regression in the new regenerate wrapper.

[kilisamemarisaaa]

The delegated call needs to be returned here. Session.prototype.regenerate() is documented and implemented to return this for chaining, but this wrapper replaces the method and currently returns undefined. I reproduced the change with the same middleware request against base d209c1f (ret === currentSession) and head b1e56d4 (ret === undefined). Please return _regenerate.call(...) and add a regression assertion for the return-value contract.

[yxshee]

I checked out b1e56d4 (it merges cleanly onto current master). Results: 175 passing and eslint clean. With index.js reverted to master, both new tests fail with 2 !== 1 store writes, so they do catch #935.

I also wrote a small script that counts MemoryStore#set calls and Set-Cookie headers for one request in each scenario (resave: false, saveUninitialized: false unless noted):

Scenario	master	this PR
regenerate → set value → save (the README login example)	2 writes	1
same, resave: true	2	1
same, saveUninitialized: true	2	1
regenerate twice, then save	2	1
regenerate → save → change value after the save callback	2 (final value stored)	2 (final value stored)
regenerate → save → reload → change value	2	2
regenerate with no manual save	1	1

Set-Cookie was sent once in every case on both branches, and the store always ended up with the last value. So the change only removes the redundant write, and a change made after the manual save is still persisted.

I can confirm the return-value point from the earlier review. var r = s.regenerate(cb) gives r === s on master and undefined here, which goes against the @return {Session} for chaining in session/session.js. Note that the existing reload and save wrappers already drop the return value on master (_reload.call(...) and _save.apply(...) aren't returned). So return _regenerate.call(...) fixes the regression this PR introduces, and doing the same for the other two would make all three consistent.

With that return added, this looks correct to me.