Calling exists? in the session store, without checking for stale sessions, was causing the cookie store to panic because we need to unpack the whole session to get its key. This commit fixes this issue and also caches exists calls for performance improvements.

2 files changed, 10 insertions, 10 deletions

diff --git a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
index fcc2287279..e9e0c26c73 100644
--- a/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/abstract_store.rb
@@ -88,7 +88,10 @@ module ActionDispatch
         end
 
         def exists?
-          @by.send(:exists?, @env)
+          return @exists if instance_variable_defined?(:@exists)
+          stale_session_check! do
+            @exists = @by.send(:exists?, @env)
+          end
         end
 
         def loaded?
diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
index 6c1567f470..7ebd532f4a 100644
--- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
+++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb
@@ -62,11 +62,12 @@ module ActionDispatch
         end
 
         def unpacked_cookie_data(env)
-          request = ActionDispatch::Request.new(env)
-          if data = request.cookie_jar.signed[@key]
-            data.stringify_keys!
-          else
-            {}
+          env["action_dispatch.request.unsigned_session_cookie"] ||= begin
+            request = ActionDispatch::Request.new(env)
+            if data = request.cookie_jar.signed[@key]
+              data.stringify_keys!
+            end
+            data || {}
           end
         end
 
@@ -78,10 +79,6 @@ module ActionDispatch
           persistent_session_id!(session_data, sid)
         end
 
-        def exists?(env)
-          ActionDispatch::Request.new(env).cookie_jar.key?(@key)
-        end
-
         def destroy(env)
           # session data is stored on client; nothing to do here
         end