diff --git a/controller.go b/controller.go
index 74c55b74..8bb64176 100644
--- a/controller.go
+++ b/controller.go
@@ -312,6 +312,10 @@ func (c *Controller) GetSecureCookie(Secret, key string) (string, bool) {
 
 	parts := strings.SplitN(val, "|", 3)
 
+	if len(parts) != 3 {
+		return "", false
+	}
+
 	vs := parts[0]
 	timestamp := parts[1]
 	sig := parts[2]