bug / clarification: session.set is pass by reference, leading to edits after calling .set to be persisted

[kaytwo]

Astro Info

Astro                    v5.1.1
Node                     v22.12.0
System                   macOS (arm64)
Package Manager          npm
Output                   static
Adapter                  @astrojs/node

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

This line sets the "data" value directly to be the passed in value, so if it's an object it's pass by reference:

astro/packages/astro/src/core/session.ts

Line 163 in a6a4a66

data: value,

Thus if you do something like

const allData = {secret: "word", notSecret: "stuff"}
Astro.session.set("allData", allData);
delete allData.secret
return allData;

The deferred saving of the session data causes the updates after the call to .set() to be persisted to the session store.

What's the expected result?

When Astro does this check:

astro/packages/astro/src/core/session.ts

Line 143 in a6a4a66

stringify(value);

It should do the full serialization (including the URL conversion) and save that to #data.value, instead of doing it later:

astro/packages/astro/src/core/session.ts

Line 224 in a6a4a66

serialized = stringify(data, {

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-muwk6ati-e1czmh2l?file=src%2Fpages%2Findex.astro

Participation

• I am willing to submit a pull request for this issue.