Session object is updated directly and set in response

[ajcrites]

Currently session attributes are set when the response is prepared. When you get the session either with req.session('key') or req.getSession you get the session object back and modifying object properties on it will update the session in the response, e.g.

const sesh = req.getSession();
const objProp = sesh.get('objProp');
objProp.existingProp = "new value";

This will set the session.objProp.existingProp to "new value" in the response even if it was not before.

My suggestion to fix this is to have session.get return a deep copy of the value. You will have to explicitly session.set in order to update the value.

[dblock]

This is reasonable. Feel free to PR this.