Cookie Expert

... do we have one handy?

[joshie76]

I've been doing some research on cookies and I'm a little (no, a lot) baffled. Nearly all the documentation I can find says that a browser should allow 20 cookies per host (domain) each of 4096 bytes in size.

However, I've been doing some testing and it seems I can only get 4096 bytes in total, not per cookie.

I've tried setting them both through javascript and server headers but I get the same results each time (4096 bytes max including cookie name etc).

Any ideas where I may be going wrong? I've been to all the obvious resources (cookie central, the netscape cookie recommendation, MSDN, RFC 2109 (the official cookie spec) and lots of others but I'm totally lost.

I don't actually need to store 20x4k cookies but trying to yield a better understanding of the little biscuits. Any ideas?

[rewboss]

The specifications indeed state that a browser should not be expected to store more than twenty cookies per server or domain, each up to 4kb including name. Moreover, a client should not be expected to store more than 300 cookies in total.

But this is client-side technology, and clients are free to accept or reject as many cookies as they want. Most modern browsers allow the user quite a bit of control over cookies. If the browser you are using is misinterpreting the guidelines, that may not have been intentional, but not actually a violation of any law set in stone.

Twenty cookies is a lot for one site, and four kilobytes is a lot for one cookie. By the time you have got to the stage of having to store that amount of information, you probably need to be thinking in terms of getting a database.