On Mon, Aug 17, 2009 at 9:34 AM, Bil Corry<bil@corry.biz> wrote:
> A bit dated, Nicholas Zakas of Yahoo! talks about the maximum number of cookies[1]:
>
> ---8<---
>    * Microsoft indicated that Internet Explorer 8 increased the cookie limit per domain to 50 cookies but I’ve found that IE7 also allows 50 cookies per domain. Granted, this may have been increased with a system patch rather than having the browser’s first version ship like this, but it’s still more than the 20 that was commonly understood to be the limit.

I discussed this issue with Eric Lawrence.  Apparently, IE raised the
cookie limit from 20 to 50 in a patch to improve compatibility with a
major site that required 24 cookies to function properly.  This patch
rendered a major Japanese bank's web site completely inoperable
because it was relying on the browser to evict the 21rst cookie and
fell over and died when it got too many cookies.  There was strong
pressure to reverse the patch, but they did not.

>    * Firefox has a per-domain cookie limit of 50 cookies.
>    * Opera has a per-domain cookie limit of 30 cookies.
>    * Safari/WebKit is the most interesting of all as it appears to have no perceivable limit through Safari 3.1. I tested setting up to 10,000 cookies and all of them were set and sent along in the Cookie header. The problem is that the header size exceeded the limit that the server could process, so an error occurred.
> --->8---

Yeah, so if I were writing a cookie implementation today, I would
definitely use 50 cookies per domain.  However, putting that as a hard
limit into the spec doesn't seem very future proof.  I think
suggesting a limit of 50 is appropriate because that's the limit used
by >90% of the market.

> He also mentions differences in cookie eviction:
>
> ---8<---
>   1. The least recently used (LRU) approach automatically kicks out the oldest cookie when the cookie limit has been reached in order to allow the newest cookie some space. Internet Explorer and Opera use this approach.
>   2. Firefox does something strange: it seems to randomly decide which cookies to keep although the last cookie set is always kept. There doesn’t seem to be any scheme it’s following at all. The takeaway? Don’t go above the cookie limit in Firefox.
> --->8---

The draft current specs LRU for cookie eviction, but I haven't figured
out a good way to test this yet.  It might be worth reading Firefox's
code to understand what algorithm they're using.

> And differences in cookie size support (although this conflicts with results Daniel Stenberg posted earlier[2]):
>
> ---8<---
>    * Firefox and Safari allow cookies with up to 4097 characters, that’s 4096 for the name and value and one for the equals sign.
>    * Opera allows cookies with up to 4096 characters, which is for the name, value, and equals sign.
>    * Internet Explorer allows cookies with up to 4095 characters, which is for the name, value and, equals sign.
> --->8---

Interesting.  I have two size limit tests, but I haven't figured out
anything conclusive here.  Looks like the limit is something on the
order of 4096.  We should definitely try to figure out some broadly
interoperable, least common denominator limits to recommend in the
server conformance section.

Adam