diff --git a/session/session.js b/session/session.js
index c3c0f15a..01c95a5c 100644
--- a/session/session.js
+++ b/session/session.js
@@ -44,9 +44,12 @@ function Session(req, data) {
  * @api public
  */
 
-Session.prototype.touch = function(){
+Object.defineProperty(Session.prototype, 'touch', { configurable: true,
+                                                    writable: true,
+                                                    enumerable: false,
+                                                    value: function(){
   return this.resetMaxAge();
-};
+} });
 
 /**
  * Reset `.maxAge` to `.originalMaxAge`.
@@ -55,10 +58,13 @@ Session.prototype.touch = function(){
  * @api public
  */
 
-Session.prototype.resetMaxAge = function(){
+Object.defineProperty(Session.prototype, 'resetMaxAge', { configurable: true,
+                                                          writable: true,
+                                                          enumerable: false,
+                                                          value: function(){
   this.cookie.maxAge = this.cookie.originalMaxAge;
   return this;
-};
+} });
 
 /**
  * Save the session data with optional callback `fn(err)`.
@@ -68,10 +74,13 @@ Session.prototype.resetMaxAge = function(){
  * @api public
  */
 
-Session.prototype.save = function(fn){
+Object.defineProperty(Session.prototype, 'save', { configurable: true,
+                                                   writable: true,
+                                                   enumerable: false,
+                                                   value: function(fn){
   this.req.sessionStore.set(this.id, this, fn || function(){});
   return this;
-};
+} });
 
 /**
  * Re-loads the session data _without_ altering
@@ -85,7 +94,10 @@ Session.prototype.save = function(fn){
  * @api public
  */
 
-Session.prototype.reload = function(fn){
+Object.defineProperty(Session.prototype, 'reload', { configurable: true,
+                                                     writable: true,
+                                                     enumerable: false,
+                                                     value: function(fn){
   var req = this.req
     , store = this.req.sessionStore;
   store.get(this.id, function(err, sess){
@@ -95,7 +107,7 @@ Session.prototype.reload = function(fn){
     fn();
   });
   return this;
-};
+} });
 
 /**
  * Destroy `this` session.
@@ -105,11 +117,14 @@ Session.prototype.reload = function(fn){
  * @api public
  */
 
-Session.prototype.destroy = function(fn){
+Object.defineProperty(Session.prototype, 'destroy', { configurable: true,
+                                                      writable: true,
+                                                      enumerable: false,
+                                                      value: function(fn){
   delete this.req.session;
   this.req.sessionStore.destroy(this.id, fn);
   return this;
-};
+} });
 
 /**
  * Regenerate this request's session.
@@ -119,7 +134,10 @@ Session.prototype.destroy = function(fn){
  * @api public
  */
 
-Session.prototype.regenerate = function(fn){
+Object.defineProperty(Session.prototype, 'regenerate', { configurable: true,
+                                                         writable: true,
+                                                         enumerable: false,
+                                                         value: function(fn){
   this.req.sessionStore.regenerate(this.req, fn);
   return this;
-};
+} });
diff --git a/test/session.js b/test/session.js
index 682cb8d0..f37dfe7e 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1420,6 +1420,24 @@ describe('session()', function(){
       });
     })
 
+    it('should have only non-enumeable properties, excepting "cookie"', function(done) {
+      var app = express()
+        .use(session({ secret: 'keyboard cat', cookie: { maxAge: min }}))
+        .use(function(req, res, next) {
+          req.session.foo = 'foo';
+          req.session.bar = 'bar';
+          var keys = [];
+          for (var key in req.session) {
+            keys.push(key);
+          }
+          res.end(keys.sort().join(','));
+        });
+
+      request(app)
+      .get('/')
+      .expect(200, 'bar,cookie,foo', done);
+    });
+
     describe('.destroy()', function(){
       it('should destroy the previous session', function(done){
         var app = express()