Maximum Cookie Size of current browsers (Year 2018)

Question

From the django docs:

Both RFC 2109 and RFC 6265 state that user agents should support cookies of at least 4096 bytes. For many browsers this is also the maximum size.

Source: https://docs.djangoproject.com/en/2.1/ref/request-response/

Is this still valid today?

What is the maximum cookie size of current browsers?

Solution 1

The cookie spec definition in RFC6265 (April 2011) is the current RFC (No new draft and no new RFC) and is supported by all major browsers (IE,Chrome,Opera,Firefox) today.

• At least 4096 bytes per cookie (as measured by the sum of the length of the cookie's name, value, and attributes).

• At least 50 cookies per domain.

• At least 3000 cookies total.

So all modern browsers support AT LEAST this. Any other limit values are a gamble

See 6.1. Limits in https://datatracker.ietf.org/doc/rfc6265/ for more details

Solution 2

You can test it out by setting and reading back a cookie size from JavaScript in an iteration if you are interested in modern browsers only.

That is what I was doing in the past. And this is exactly what this site is about, it also includes the limits by browsers.

But keep in mind that the matching cookies will travel with every HTTP requests so they could dramatically affect the perceived response time.

Comments

[Dai]

I note this does not mean that browsers support 50 cookies * 4096 bytes == 204,800 bytes == 204KiB per domain. I find that Safari and Chrome start to reject cookies if the total data for a domain exceeds something between 5-8KB.

[Mumrah81]

Hi @Dai, i don't know for Safari but the size limit in Chrome is indeed 204,800 bytes per domain. From my tests the size is calculated summing the lengths of hostname + cookiepath + cookiename + unencrypted cookie value. Test done on Chrome 71.0.3578.98. How did you find a limit of 5-8Kb?

[Dai]

I get warnings in my Chrome developer console when the total size of all Set-Cookie headers in a response exceeds 4096 characters. So I guess, it's true that Chrome can store over 4096 characters, but they can't all be set in a single response?

[Mumrah81]

After some more testing, it appears you're right. If providing more than one Set-Cookie headers then the limit of 4096 bytes is applied on the concatenated value of all Set-Cookie headers. You can still create more than one cookie provided the creation is done in only one header. With multiple Set-Cookie headers it seems only the last one works. The only way to reach the 204KB per domain limit is to create the cookies using javascript. Another strange point is cookies created using the Set-Cookie headers aren't inserted in the Chrome's sqllite database but still sent in the next request

[Andy Ray]

@Mumrah81 given how upvoted this answer is, I chose to update the wording, which is dangerous, to reflect what Dai pointed out. This is a better question+answer: stackoverflow.com/questions/640938/…