# Session-only cookie corruption in Ruby web apps

**URL:** <https://metaruby.com/t/session-only-cookie-corruption-in-ruby-web-apps/1370>\
**Category:** Ruby Chat\
**Tags:** ruby, rails\
**Created:** [November 21, 2017, 5:30pm UTC](https://metaruby.com/t/session-only-cookie-corruption-in-ruby-web-apps/1370 "2017-11-21T17:30:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mwpastore](https://metaruby.com/letter_avatar_proxy/v4/letter/m/e19b73/32.png) [@mwpastore](https://metaruby.com/u/mwpastore)\
**Post date:** [November 21, 2017, 5:30pm UTC](https://metaruby.com/t/session-only-cookie-corruption-in-ruby-web-apps/1370/1 "2017-11-21T17:30:52Z")

</div>

Hi folks,

I’ve uncovered what I believe is a flaw in how Rack and Rails handle large cookies. I’ve written about it [here](https://perlkour.pl/2017/11/ruby-cookie-corruption/) and published a gem that mitigates the issue [here](https://github.com/mwpastore/rack-protection-maximum_cookie#readme). Thanks in advance for your feedback!

Mike