diff --git a/spec/Main.hs b/spec/Main.hs
new file mode 100644
--- /dev/null
+++ b/spec/Main.hs
@@ -0,0 +1,1 @@
+{-# OPTIONS_GHC -F -pgmF hspec-discover #-}
diff --git a/spec/MiddlewareSpec.hs b/spec/MiddlewareSpec.hs
new file mode 100644
--- /dev/null
+++ b/spec/MiddlewareSpec.hs
@@ -0,0 +1,89 @@
+{-# LANGUAGE OverloadedStrings #-}
+
+module MiddlewareSpec where
+
+import Test.Hspec
+import Test.Hspec.Wai
+import Test.Hspec.Wai.Internal (withApplication)
+import System.Environment
+import Cookie.Secure.Middleware
+import Network.Wai
+import Network.Wai.Test hiding (request)
+import Network.HTTP.Types
+import Network.HTTP.Types.Status
+import Network.HTTP.Types.Header
+import Data.Foldable
+import Data.Maybe
+import qualified Data.ByteString.Char8 as B
+import qualified Data.ByteString.Lazy.Char8 as LB
+
+spec :: Spec
+spec = do
+  before_ setupEnvironment $ do
+    describe "secureCookies middleware" $ do
+      it "does not encrypt cookie names" $ do
+        cookie <- getResponseCookie
+        cookie `shouldStartWith` "SessionId="
+
+      it "encrypts cookie values" $ do
+        cookie <- getResponseCookie
+        cookie `shouldNotContain` sessionId
+
+      it "does not decrypt cookie names" $ do
+        cookie <- getRequestCookie
+        cookie `shouldStartWith` "SessionId="
+
+      it "decrypts cookie values" $ do
+        cookie <- getRequestCookie
+        cookie `shouldEndWith` sessionId
+
+setupEnvironment :: IO ()
+setupEnvironment =
+     setEnv "WAI_COOKIE_ENCRYPTION_KEY" "00000000000000000000000000000000"
+  >> setEnv "WAI_COOKIE_VALIDATION_KEY" "00000000000000000000000000000000"
+
+getResponseCookie :: IO String
+getResponseCookie =
+  withApplication secureApp
+    $ getHeaderValue hSetCookie . simpleHeaders <$> get "/"
+
+getRequestCookie :: IO String
+getRequestCookie =
+  withApplication secureApp
+    $   LB.unpack . simpleBody
+    <$> request
+          methodGet
+          "/"
+          [ ( hCookie
+            , B.pack exampleSignedEncryptedCookieValue
+            )
+          ]
+          ""
+
+exampleSignedEncryptedCookieValue :: String
+exampleSignedEncryptedCookieValue = "SessionId=aXYsUWxmbDhWLW90alJDTGtHSUh2Uno5Z3xPSkhTYjZsOTFsVnA|signature,be2ee0eb3d894ef671a8475d78c635d28e844011eda7ae16c47830333466d1e0"
+
+getHeaderValue :: HeaderName -> [Header] -> String
+getHeaderValue header =
+  B.unpack
+    . snd
+    . fromMaybe ("", "")
+    . findHeader header
+    where
+      findHeader header = find $ (== header) . fst
+
+secureApp :: Application
+secureApp = secureCookies app
+
+app :: Application
+app request responder = responder
+  $ responseLBS
+      status200
+      [ ( hSetCookie
+        , B.pack $ "SessionId=" ++ sessionId ++ "; Max-Age=86400"
+        )
+      ]
+      (LB.pack . getHeaderValue hCookie $ requestHeaders request)
+
+sessionId :: String
+sessionId = "123456789"
diff --git a/src/Cookie/Secure.hs b/src/Cookie/Secure.hs
--- a/src/Cookie/Secure.hs
+++ b/src/Cookie/Secure.hs
@@ -37,7 +37,7 @@
 verifyAndDecrypt authKey encryptKey message =
   deserialize message >>= verifyAndDecryptDeserialized
     where
-      verifyAndDecryptDeserialized signed = 
+      verifyAndDecryptDeserialized signed =
         if verify authKey signed
         then maybeCryptoError $ decrypt encryptKey (getSignable signed)
         else Nothing
diff --git a/src/Cookie/Secure/Middleware.hs b/src/Cookie/Secure/Middleware.hs
--- a/src/Cookie/Secure/Middleware.hs
+++ b/src/Cookie/Secure/Middleware.hs
@@ -87,12 +87,19 @@
   <*> verifyAndDecryptCookieHeaderValue value
     where
       verifyAndDecryptCookieHeaderValue value =
-        BS.intercalate "; "
+        BS.intercalate "; " . catMaybes
         <$> mapM verifyAndDecryptCookie
         (splitOn "; " (BS.unpack value))
-      verifyAndDecryptCookie cookie =
+      verifyAndDecryptCookie cookie = do
+        let cookieNameValueList = map BS.pack $ splitOn "=" cookie
+        let cName = head cookieNameValueList
+        let cValue = last cookieNameValueList
+
+        encryptedValue <- verifyAndDecryptIO cValue
+
         -- OPTIMIZE: maybe silently dropping cookies which fail to verify
         -- or decrypt isn't the best idea?
-        BS.intercalate "=" . catMaybes
-        <$> mapM verifyAndDecryptIO
-        (map BS.pack (splitOn "=" cookie))
+        case encryptedValue of
+          Nothing -> pure Nothing
+          Just encryptedValue' ->
+            return . Just $ BS.intercalate "=" [cName, encryptedValue']
diff --git a/wai-secure-cookies.cabal b/wai-secure-cookies.cabal
--- a/wai-secure-cookies.cabal
+++ b/wai-secure-cookies.cabal
@@ -1,12 +1,12 @@
 name:                wai-secure-cookies
-version:             0.1.0.2
+version:             0.1.0.3
 description:         WAI middleware to automatically encrypt and sign cookies
 homepage:            https://github.com/habibalamin/wai-secure-cookies
 license:             MIT
 license-file:        LICENSE
 author:              Habib Alamin
 maintainer:          ha.alamin@gmail.com
-copyright:           © حبيب الامين‪ 2017
+copyright:           © حبيب الامين ‪2017
 category:            Web
 build-type:          Simple
 cabal-version:       >=1.10
@@ -28,7 +28,24 @@
                      , memory >= 0.14 && < 0.15
                      , random >= 1.1 && < 2
                      , split >= 0.2 && < 0.3
-                     , http-types >= 0.9 && < 0.10
+                     , http-types >= 0.12.1 && < 0.13
+
+test-suite wai-secure-cookies-test
+  hs-source-dirs:      spec
+  default-language:    Haskell2010
+  other-modules:       MiddlewareSpec
+  type:                exitcode-stdio-1.0
+  main-is:             Main.hs
+  build-depends:       base >= 4.7 && < 5
+                     , bytestring >= 0.10 && < 0.11
+                     , wai >= 3.2 && < 4
+                     , wai-extra >= 3.0 && < 4
+                     , http-types >= 0.12.1 && < 0.13
+                     , wai-secure-cookies
+                     , hspec
+                     , hspec-expectations
+                     , hspec-wai
+  ghc-options:         -threaded -O2 -rtsopts -with-rtsopts=-N
 
 executable waicookie-genkey
   hs-source-dirs:      keygensrc