Can set session-only cookies

lib/cookie-sessions.js

@@ -157,10 +157,13 @@ exports.valid = function(secret, timeout, str){
  var hmac_sig = exports.hmac_signature(
  secret, parts.timestamp, parts.data_blob
  );
- return (
- parts.hmac_signature === hmac_sig &&
- parts.timestamp + timeout > new Date().getTime()
- );
+
+ var validatedTimeout = true;
+ if(timeout){
+ validatedTimeout = parts.timestamp + timeout > new Date().getTime();
+ }
+
+ return (parts.hmac_signature === hmac_sig && validatedTimeout);
 };
 
 exports.decrypt = function(secret, str){
@@ -210,10 +213,13 @@ exports.readSession = function(key, secret, timeout, req){
  if(cookies[key]){
  return exports.deserialize(secret, timeout, cookies[key]);
  }
- return undefined;
+ return {};
 };
 
 
 exports.expires = function(timeout){
- return (new Date(new Date().getTime() + (timeout))).toUTCString();
+ if(timeout){
+ return (new Date(new Date().getTime() + (timeout))).toUTCString();
+ }
+ return null;
 };

test/test-cookie-sessions.js

@@ -305,7 +305,7 @@ exports['readSession no cookie'] = function(test){
  var r = sessions.readSession(
  'node_session', 'secret', 12, 'request_obj'
  );
- test.same(r, undefined, 'return empty session');
+ test.same(r, {}, 'return empty session');
 
  // restore copied functions
  sessions.readCookies = readCookies;