Language: TypeScript
Label: safe
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
  async logIn(request: FastifyRequest, user: any) {
    const object = await this.serializeUser(user, request)
    // Handle sessions using @fastify/session
    if (request.session.regenerate) {
      // regenerate session to guard against session fixation
      await request.session.regenerate()
    }
    request.session.set(this.key, object)
  }