Language: TypeScript
Label: safe
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
  async logOut(request: FastifyRequest) {
    request.session.set(this.key, undefined)
    if (request.session.regenerate) {
      await request.session.regenerate()
    }
  }