diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index f74534b92..49dd6e2cd 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -125,6 +125,7 @@ class UserLoginHandler extends Handler {
         this.session.sudo = null;
         this.session.scope = PERM.PERM_ALL.toString();
         this.session.save = rememberme;
+        this.session.recreate = true;
         this.response.redirect = redirect || ((this.request.referer || '/login').endsWith('/login')
             ? this.url('homepage') : this.request.referer);
     }
@@ -325,6 +326,7 @@ class UserRegisterWithCodeHandler extends Handler {
         this.session.uid = uid;
         this.session.sudoUid = null;
         this.session.scope = PERM.PERM_ALL.toString();
+        this.session.recreate = true;
         this.response.redirect = tdoc.redirect || this.url('home_settings', { category: 'preference' });
     }
 }
@@ -484,6 +486,7 @@ class OauthCallbackHandler extends Handler {
                     await user.setById(udoc._id, { loginat: new Date(), loginip: this.request.ip });
                     this.session.uid = udoc._id;
                     this.session.scope = PERM.PERM_ALL.toString();
+                    this.session.recreate = true;
                     this.response.redirect = '/';
                     return;
                 }
diff --git a/packages/hydrooj/src/service/layers/base.ts b/packages/hydrooj/src/service/layers/base.ts
index fd0f3012f..d7a75ae2d 100644
--- a/packages/hydrooj/src/service/layers/base.ts
+++ b/packages/hydrooj/src/service/layers/base.ts
@@ -1,6 +1,6 @@
 import { PassThrough } from 'stream';
 import type { Next } from 'koa';
-import { cloneDeep, pick } from 'lodash';
+import { cloneDeep, omit, pick } from 'lodash';
 import { PERM } from '../../model/builtin';
 import * as system from '../../model/system';
 import token from '../../model/token';
@@ -80,8 +80,8 @@ export default async (ctx: KoaContext, next: Next) => {
         : system.get('session.unsaved_expire_seconds');
     if (!ctx.session._id && !Object.getOwnPropertyNames(ctx.session).length) return;
     Object.assign(ctx.session, { updateIp: request.ip, updateUa: ua });
-    if (ctx.session._id) {
-        await token.update(ctx.session._id, token.TYPE_SESSION, expireSeconds, ctx.session);
+    if (ctx.session._id && !ctx.session.recreate) {
+        await token.update(ctx.session._id, token.TYPE_SESSION, expireSeconds, omit(ctx.session, ['_id', 'recreate']));
     } else {
         Object.assign(ctx.session, { createIp: request.ip, createUa: ua, createHost: request.host });
         [ctx.session._id] = await token.add(token.TYPE_SESSION, expireSeconds, ctx.session);