Avoid deserializing cookies too early, which causes session objects to not be available yet. Unfortunately, could not reproduce this in a test case.

1 files changed, 6 insertions, 1 deletions

diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
index 7c5626735b..6c1567f470 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
@@ -65,8 +65,9 @@ module ActionDispatch
           request = ActionDispatch::Request.new(env)
           if data = request.cookie_jar.signed[@key]
             data.stringify_keys!
+          else
+            {}
           end
-          data
         end
 
         def set_cookie(request, options)
@@ -77,6 +78,10 @@ module ActionDispatch
           persistent_session_id!(session_data, sid)
         end
 
+        def exists?(env)
+          ActionDispatch::Request.new(env).cookie_jar.key?(@key)
+        end
+
         def destroy(env)
           # session data is stored on client; nothing to do here
         end