Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My main comment here is about the tests - I'd like to see if we can refactor things so that the tests can directly test some of the cookie logic, and so that they don't duplicate said logic in the tests themselves.

Another approach might be to have glass-box tests by having an internal header with the middleware definition, so that tests can directly check the contents of the cookie cache (but so that client code still just gets an opaque middleware instance).