WS-2018-0229

rails-session-decoder is missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information...