From a0918442c1e66fefe3a8fcbb68b935e4fc20ea79 Mon Sep 17 00:00:00 2001
From: Naoto Kato <naoto.kato@plaid.co.jp>
Date: Thu, 25 Feb 2021 22:29:24 +0900
Subject: [PATCH] feat: Changed the behavior when createdAt does not exist

---
 index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/index.js b/index.js
index a2a31900..d39542e0 100644
--- a/index.js
+++ b/index.js
@@ -488,8 +488,8 @@ function session(options) {
         return false;
       }
       if (!sess || !sess.cookie || !sess.cookie.createdAt) {
-        debug('session should be timed out, but the createdAt value is not saved')
-        return true;
+        debug('Absolute session timeout is invalid because the createdAt value is not saved.')
+        return false;
       }
       var createdDate = new Date(sess.cookie.createdAt);
       var nowDate = new Date();