Is it expected that the client socket.remotePort changes between routes?

I am a creating a Node JS app where I want to use the client's ip and port number along with an email address to create a unique hash. Within the signup route handler, the req.socket.remotePort remains the same in both get and post functions. But when the route is changed to activation, the req.socket.remotePort gets incremented (always previous port number + 1).

Is this expected? Is there way to keep a stable and consistent remote port?

signup.js route

var express = require('express');
var lib = require('../lib.js');
var router = express.Router();

var nodemailer = require('nodemailer');

router.get('/', function(req, res, next) {
  if(!Object.hasOwn(req.params, 'email')) {
    req.params.email = "";
  }
  res.render('signup', { title: 'Signup', email: req.params.email, ip: req.socket.remoteAddress, port: req.socket.remotePort });
});

router.post('/', function(req, res, next) {
	var transporter = nodemailer.createTransport({
	service: 'gmail',
	auth: {
		user: 'authorize@example.com',
		pass: 'abc123'
	}});

	var hashCode = lib.hashCode(req.body.email + req.socket.remoteAddress + req.socket.remotePort);
	var mailOptions = {
		from: 'authorize@example.com',
		to: req.body.email,
		subject: 'Activiation Code',
		text: 'Your activiation code is: ' + hashCode
	};
  
	transporter.sendMail(mailOptions, function(error, info){
		if (error) {
			console.log(error);
		} else {
			console.log('Email sent: ' + info.response);
			res.redirect('/authorize?email=' + req.body.email);
		}
	});
});

module.exports = router;

Authorization route

var express = require('express');
var lib = require('../lib.js');
var router = express.Router();

router.get('/', function(req, res, next) {
  if(!Object.hasOwn(req.query, 'authCode')) {
    req.query.authCode = "";
  }
  res.render('authorize', { title: 'Authorize', email: req.query.email, ip: req.socket.remoteAddress(), port: req.socket.remotePort, authCode: req.query.authCode });
});

router.post('/', function(req, res, next) {
	// HERE IS WHERE THE PROBLEM MANIFEST
	// the remotePort is different now (last port number + 1)
	// so the always generates a different hash and so fails to authorize
	var hashCode = lib.hashCode(req.query.email + req.socket.remoteAddress + req.socket.remotePort);
	if(hashCode != req.body.authCode) {
		console.log('Invalid')
	} else {
		console.log('Valid')
	}
});

module.exports = router;

The short answer is no, the HTTP 1.1 specification does not make any guarantees about the remote port.

This is a fact that has been taken advantage of by browsers to speed up their requests; there can only be one concurrent connection from a client to server on a specific combination of IP and port, so to speed up browser requests multiple connections are used: en.wikipedia.org/wiki/HTTP_persistent_connection

As per the RFC: "As a result, a server MUST NOT assume that two requests on the same connection are from the same user agent unless the connection is secured and specific to that agent. Some non-standard HTTP extensions (e.g., [RFC4559]) have been known to violate this requirement, resulting in security and interoperability problems." https://www.ietf.org/rfc/rfc7230.html

Of course you may violate the specification if you control both the client and server, but I'd urge you to consider a different solution first.