Fix resaving already-saved reloaded session at end of request

fixes expressjs#383
closes expressjs#384

Author: dotchev

HISTORY.md

@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix resaving already-saved reloaded session at end of request
+
 1.14.2 / 2016-10-30
 ===================
 

index.js

@@ -364,14 +364,30 @@ function session(options) {
 
     // wrap session methods
     function wrapmethods(sess) {
+      var _reload = sess.reload
       var _save = sess.save;
 
+      function reload(callback) {
+        debug('reloading %s', this.id)
+        _reload.call(this, function () {
+          wrapmethods(req.session)
+          callback.apply(this, arguments)
+        })
+      }
+
       function save() {
         debug('saving %s', this.id);
         savedHash = hash(this);
         _save.apply(this, arguments);
       }
 
+      Object.defineProperty(sess, 'reload', {
+        configurable: true,
+        enumerable: false,
+        value: reload,
+        writable: true
+      })
+
       Object.defineProperty(sess, 'save', {
         configurable: true,
         enumerable: false,

test/session.js

@@ -1714,6 +1714,42 @@ describe('session()', function(){
           })
         })
       })
+
+      it('should prevent end-of-request save on reloaded session', function (done) {
+        var count = 0
+        var store = new session.MemoryStore()
+        var server = createServer({ store: store }, function (req, res) {
+          req.session.hit = true
+          req.session.reload(function () {
+            req.session.save(function (err) {
+              if (err) return res.end(err.message)
+              res.end('saved')
+            })
+          })
+        })
+
+        var _set = store.set
+        store.set = function set(sid, sess, callback) {
+          count++
+          _set.call(store, sid, sess, callback)
+        }
+
+        request(server)
+        .get('/')
+        .expect(200, 'saved', function (err, res) {
+          if (err) return done(err)
+          assert.equal(count, 1)
+          count = 0
+          request(server)
+          .get('/')
+          .set('Cookie', cookie(res))
+          .expect(200, 'saved', function (err) {
+            if (err) return done(err)
+            assert.equal(count, 1)
+            done()
+          })
+        })
+      })
     })
 
     describe('.touch()', function () {