I'm more looking at what one would expect from `session_expired?` when looking at the method alone.

To correctly read as your definition, you'd at least have to put the `session[:updated_at].nil?` and `Setting.session_ttl.to_i >= 5` into `session_expired?`. Otherwise a session can expire(according to the method) despite a too low TTL that should not result in expiring sessions or a session doesn't expire despite not having an updated_at value, which it always should.

Generally, I'd also expect a method checking for session expiry to return false when session expiry is disabled, since a session is never expired then. But if you have another opinion here, I can live with that.