diff --git a/CHANGES.md b/CHANGES.md
index 3b4b8dc0b..430fafcdd 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -5,6 +5,7 @@
 ### Changed
 
 * Fix actix_http::h1::dispatcher so it returns when HW_BUFFER_SIZE is reached. Should reduce peak memory consumption during large uploads. [#1550]
+* Migrate cookie handling to `cookie` crate. Actix-web no longer requires `ring` dependency.
 
 ## [3.0.0-alpha.3] - 2020-05-21
 
diff --git a/actix-http/CHANGES.md b/actix-http/CHANGES.md
index c19e40e4c..49599b9be 100644
--- a/actix-http/CHANGES.md
+++ b/actix-http/CHANGES.md
@@ -1,5 +1,11 @@
 # Changes
 
+## [Unreleased]
+
+### Changed
+
+* Migrate cookie handling to `cookie` crate.
+
 ## [2.0.0-alpha.4] - 2020-05-21
 
 ### Changed
diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml
index 3429d058b..8b9b8c825 100644
--- a/actix-http/Cargo.toml
+++ b/actix-http/Cargo.toml
@@ -70,7 +70,7 @@ lazy_static = "1.4"
 language-tags = "0.2"
 log = "0.4"
 mime = "0.3"
-percent-encoding = "2.1" # TODO: remove
+percent-encoding = "2.1"
 pin-project = "0.4.17"
 rand = "0.7"
 regex = "1.3"
@@ -81,9 +81,6 @@ slab = "0.4"
 serde_urlencoded = "0.6.1"
 time = { version = "0.2.7", default-features = false, features = ["std"] }
 
-# for secure cookie
-ring = { version = "0.16.9", optional = true } # TODO: remove
-
 # compression
 brotli2 = { version="0.3.2", optional = true }
 flate2 = { version = "1.0.13", optional = true }
diff --git a/actix-http/src/test.rs b/actix-http/src/test.rs
index 58b9191a4..b79f5a73c 100644
--- a/actix-http/src/test.rs
+++ b/actix-http/src/test.rs
@@ -1,6 +1,5 @@
 //! Test Various helpers for Actix applications to use during testing.
 use std::convert::TryFrom;
-use std::fmt::Write as FmtWrite;
 use std::io::{self, Read, Write};
 use std::pin::Pin;
 use std::str::FromStr;
@@ -162,17 +161,17 @@ impl TestRequest {
         head.version = inner.version;
         head.headers = inner.headers;
 
-        let mut cookie = String::new();
-        for c in inner.cookies.delta() {
+        let cookie: String = inner
+            .cookies
+            .delta()
             // ensure only name=value is written to cookie header
-            let c = Cookie::new(c.name(), c.value());
-            let _ = write!(&mut cookie, "; {}", c.encoded());
-        }
+            .map(|c| Cookie::new(c.name(), c.value()).encoded().to_string())
+            .collect::<Vec<_>>()
+            .join("; ");
+
         if !cookie.is_empty() {
-            head.headers.insert(
-                header::COOKIE,
-                HeaderValue::from_str(&cookie.as_str()[2..]).unwrap(),
-            );
+            head.headers
+                .insert(header::COOKIE, HeaderValue::from_str(&cookie).unwrap());
         }
 
         req
diff --git a/awc/src/request.rs b/awc/src/request.rs
index 27535786d..3dd8cb2ce 100644
--- a/awc/src/request.rs
+++ b/awc/src/request.rs
@@ -1,5 +1,4 @@
 use std::convert::TryFrom;
-use std::fmt::Write as FmtWrite;
 use std::rc::Rc;
 use std::time::Duration;
 use std::{fmt, net};
@@ -526,16 +525,18 @@ impl ClientRequest {
 
         // set cookies
         if let Some(ref mut jar) = self.cookies {
-            let mut cookie = String::new();
-            for c in jar.delta() {
+            let cookie: String = jar
+                .delta()
                 // ensure only name=value is written to cookie header
-                let c = Cookie::new(c.name(), c.value());
-                let _ = write!(&mut cookie, "; {}", c.encoded());
+                .map(|c| Cookie::new(c.name(), c.value()).encoded().to_string())
+                .collect::<Vec<_>>()
+                .join("; ");
+
+            if !cookie.is_empty() {
+                self.head
+                    .headers
+                    .insert(header::COOKIE, HeaderValue::from_str(&cookie).unwrap());
             }
-            self.head.headers.insert(
-                header::COOKIE,
-                HeaderValue::from_str(&cookie.as_str()[2..]).unwrap(),
-            );
         }
 
         let mut slf = self;
diff --git a/awc/src/test.rs b/awc/src/test.rs
index 34382f9a0..68e5c9dc5 100644
--- a/awc/src/test.rs
+++ b/awc/src/test.rs
@@ -1,6 +1,5 @@
 //! Test helpers for actix http client to use during testing.
 use std::convert::TryFrom;
-use std::fmt::Write as FmtWrite;
 
 use actix_http::cookie::{Cookie, CookieJar};
 use actix_http::http::header::{self, Header, HeaderValue, IntoHeaderValue};
@@ -87,15 +86,10 @@ impl TestResponse {
     pub fn finish(self) -> ClientResponse {
         let mut head = self.head;
 
-        let mut cookie = String::new();
-        for c in self.cookies.delta() {
-            let c = Cookie::new(c.name(), c.value());
-            let _ = write!(&mut cookie, "; {}", c.encoded());
-        }
-        if !cookie.is_empty() {
+        for cookie in self.cookies.delta() {
             head.headers.insert(
                 header::SET_COOKIE,
-                HeaderValue::from_str(&cookie.as_str()[2..]).unwrap(),
+                HeaderValue::from_str(&cookie.encoded().to_string()).unwrap(),
             );
         }
 
diff --git a/awc/src/ws.rs b/awc/src/ws.rs
index c733536ec..6ad660c41 100644
--- a/awc/src/ws.rs
+++ b/awc/src/ws.rs
@@ -1,6 +1,5 @@
 //! Websockets client
 use std::convert::TryFrom;
-use std::fmt::Write as FmtWrite;
 use std::net::SocketAddr;
 use std::rc::Rc;
 use std::{fmt, str};
@@ -244,16 +243,18 @@ impl WebsocketsRequest {
 
         // set cookies
         if let Some(ref mut jar) = self.cookies {
-            let mut cookie = String::new();
-            for c in jar.delta() {
+            let cookie: String = jar
+                .delta()
                 // ensure only name=value is written to cookie header
-                let c = Cookie::new(c.name(), c.value());
-                let _ = write!(&mut cookie, "; {}", c.encoded());
+                .map(|c| Cookie::new(c.name(), c.value()).encoded().to_string())
+                .collect::<Vec<_>>()
+                .join("; ");
+
+            if !cookie.is_empty() {
+                self.head
+                    .headers
+                    .insert(header::COOKIE, HeaderValue::from_str(&cookie).unwrap());
             }
-            self.head.headers.insert(
-                header::COOKIE,
-                HeaderValue::from_str(&cookie.as_str()[2..]).unwrap(),
-            );
         }
 
         // origin