Maximum Cookie Size of current browsers (Year 2018)

http cross-browser rfc
guettli picture guettli · Sep 6, 2018 · Viewed 11.3k times · Source

From the django docs:

Both RFC 2109 and RFC 6265 state that user agents should support cookies of at least 4096 bytes. For many browsers this is also the maximum size.

Source: https://docs.djangoproject.com/en/2.1/ref/request-response/

Is this still valid today?

What is the maximum cookie size of current browsers?

Answer

Mumrah81 picture Mumrah81 · Sep 25, 2018

The cookie spec definition in RFC6265 (April 2011) is the current RFC (No new draft and no new RFC) and is supported by all major browsers (IE,Chrome,Opera,Firefox) today.

  • At least 4096 bytes per cookie (as measured by the sum of the length of the cookie's name, value, and attributes).

  • At least 50 cookies per domain.

  • At least 3000 cookies total.

So all modern browsers support AT LEAST this. Any other limit values are a gamble

See 6.1. Limits in https://datatracker.ietf.org/doc/rfc6265/ for more details

Related questions

What requests do browsers' "F5" and "Ctrl + F5" refreshes generate?

Is there a standard for what actions F5 and Ctrl + F5 trigger in web browsers? I once did experiment in IE6 and Firefox 2.x. The F5 refresh would trigger a HTTP request sent to the server with an If-Modified-Since header, …

Read More
Are the PUT, DELETE, HEAD, etc methods available in most web browsers?

I've seen a couple questions around here like How to debug RESTful services, which mentions: Unfortunately that same browser won't allow me to test HTTP PUT, DELETE, and to a certain degree even HTTP POST. I've also heard that browsers …

Read More
Should PUT and DELETE be used in forms?

Assuming my web application has full support of PUT and DELETE on the server side, should I make use of them? Basically my question is how many browsers support this: <form method="PUT"> or <form method="DELETE"&…

Read More