diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 1.4.9.1
+
+* Deal better with multiple cookie headers
+
 ## 1.4.9
 
 * Add simple authentication helpers [#962](https://github.com/yesodweb/yesod/pull/962)
diff --git a/Yesod/Core/Class/Yesod.hs b/Yesod/Core/Class/Yesod.hs
--- a/Yesod/Core/Class/Yesod.hs
+++ b/Yesod/Core/Class/Yesod.hs
@@ -695,11 +695,11 @@
     load = do
       date <- getCachedDate
       return (sess date, save date)
-    sess date = fromMaybe Map.empty $ do
-      raw <- lookup "Cookie" $ W.requestHeaders req
-      val <- lookup sessionName $ parseCookies raw
+    sess date = Map.unions $ do
+      raw <- [v | (k, v) <- W.requestHeaders req, k == "Cookie"]
+      val <- [v | (k, v) <- parseCookies raw, k == sessionName]
       let host = "" -- fixme, properly lock sessions to client address
-      decodeClientSession key date host val
+      maybe [] return $ decodeClientSession key date host val
     save date sess' = do
       -- We should never cache the IV!  Be careful!
       iv <- liftIO CS.randomIV
diff --git a/yesod-core.cabal b/yesod-core.cabal
--- a/yesod-core.cabal
+++ b/yesod-core.cabal
@@ -1,5 +1,5 @@
 name:            yesod-core
-version:         1.4.9
+version:         1.4.9.1
 license:         MIT
 license-file:    LICENSE
 author:          Michael Snoyman <michael@snoyman.com>