Passport.js session management requiring manual session regeneration

Passport.js handles user session serialization and deserialization, but it does not automatically rotate the session ID upon a successful authentication. While the framework manages the user object within the session store, the underlying session identifier remains constant unless the developer explicitly intervenes.

To mitigate session fixation risks, current implementations require manually invoking req.session.regenerate() within the callback. This creates a challenge when the authentication strategy involves side-effects, such as user record creation or profile updates, where network retries or rapid repeated requests might lead to duplicate writes if not handled idempotently.

• What is the recommended pattern for ensuring idempotency in strategies that perform database writes before session regeneration?
• Is there a built-in configuration in Passport.js to trigger session rotation automatically without manual-level logic?