Preventing duplicate session writes during Passport.js authentication retries

When implementing custom retry logic for authentication in a Passport.js environment, the authenticate middleware is often re-invoked after an initial failure. While Passport typically writes user data to the session store only upon successful verification, the interaction between retry loops and session store idempotency is not explicitly defined in the core documentation.

Depending on the session store implementation, repeated successful calls to the authentication middleware may trigger multiple write operations. If the store does not automatically merge or overwrite based on the session ID, this could lead to redundant entries or unexpected state overhead.

Technical Constraints

• The behavior is dependent on whether the underlying session store (e.g., Redis, MongoDB) treats the write as an idempotent update or a new entry.
• Custom strategies performing external side effects may trigger those effects on every retry attempt.

What is the recommended pattern to ensure that retrying the authenticate middleware does not result in duplicate writes to the session store? Does Passport provide a mechanism to track authentication attempts within a single request cycle to prevent redundant session updates?