Action Pack is a framework for handling and responding to web requests. An issue exists where `ActionDispatch::Cookies` reads a signed or encrypted cookie written under a rotated secret (`config.action dispatch.cookies rotations`) or in a format that a `:hybrid` cookie serializer migrates from. The system writes the cookie back to the response in the current format, ignoring `request.session options[:skip]`. Because `ActiveStorage::DisableSession` relies on this option to keep session cookies off public, immutable responses of Active Storage proxy controllers, a request with an old-format session cookie may result in a rewritten session cookie being sent in the `Set-Cookie` header of a cacheable response. If a shared cache stores this response and its `Set-Cookie` header, it could serve one user's session to subsequent requesters of the same URL or serve an attacker's session to other users. This occurs when applications serve Active Storage files through proxy controllers, have cookie rotation or a `:hybrid` serializer migration configured, and operate behind a cache that stores `Set-Cookie` on public responses.