Can set session-only cookies

lib/cookie-sessions.js

@@ -157,10 +157,13 @@ exports.valid = function(secret, timeout, str){
     var hmac_sig = exports.hmac_signature(
         secret, parts.timestamp, parts.data_blob
     );
-    return (
-        parts.hmac_signature === hmac_sig &&
-        parts.timestamp + timeout > new Date().getTime()
-    );
+
+    var validatedTimeout = true;
+    if(timeout){
+        validatedTimeout = parts.timestamp + timeout > new Date().getTime();
+    }
+
+    return (parts.hmac_signature === hmac_sig && validatedTimeout);
 };
 
 exports.decrypt = function(secret, str){
@@ -210,10 +213,13 @@ exports.readSession = function(key, secret, timeout, req){
     if(cookies[key]){
         return exports.deserialize(secret, timeout, cookies[key]);
     }
-    return undefined;
+    return {};
 };
 
 
 exports.expires = function(timeout){
-    return (new Date(new Date().getTime() + (timeout))).toUTCString();
+    if(timeout){
+        return (new Date(new Date().getTime() + (timeout))).toUTCString();
+    }
+    return null;
 };

test/test-cookie-sessions.js

@@ -305,7 +305,7 @@ exports['readSession no cookie'] = function(test){
     var r = sessions.readSession(
         'node_session', 'secret', 12, 'request_obj'
     );
-    test.same(r, undefined, 'return empty session');
+    test.same(r, {}, 'return empty session');
 
     // restore copied functions
     sessions.readCookies = readCookies;