Provider.js - why regenerateSessionId after login?

The session is being regenerated to prevent session fixation attacks.
When the user is authenticated and their session data is set, the regeneration of the session ID ensures that if there was an old session ID, it is invalidated and replaced with a new one. It is important after logging in, as it makes it harder to hijack the session using an old or known session ID.

See more: