HTTP Cookie - size

Wikipedia gives a very detailed info about HTTP Cookies - http://en.wikipedia.org/wiki/HTTP_cookie, it's usage, advantages, disadvantages etc. I was curious perticularly about the size limitations of HTTP cookie. W3C has published specifications around HTTP State Management Mechanism, which gives further details about recommandations for the brower / server implementation groups about the usage of cookies. Accourding to the official version, it doesn't impose any upper limit to the user agent (browser) about handling cookies, though it says that user agent should atleast support 300 cookies, at least 4096 bytes per cookie, and at least 20 cookies per unique host or domain name. 

If you think about this, it's a relatively a big storage if I can use 20*4096 bytes =~ 80KB local storage per domain. Now, I wanted to make sure every thing works as defined before I jump in to a cookie-base application (like a database). So, I created a simple aspx page with following code in it. 

<%
HttpCookie c = new HttpCookie(String.Format("CTest{0}{1}",DateTime.Now.Minute,DateTime.Now.Second),
    "onrujwog61jx%7CMUeqvE58dcrfTUP2ylgfKvrhdFV69%2Boy55%2FNHMPOiIYTkNRBeASWcn1oZlWrdi5WxAVYuez14YMN");
c.Expires = new DateTime(2011, 1, 25);
Response.Cookies.Add(c);
%>

Refresh the page multiple times and see what happens (You could try this with increasing the size of one cookie to 5/6 kb, so your will see the problem with few page reloads). You will soon get the following message from your server.

Bad Request - Request Too Long

---

HTTP Error 400. The size of the request headers is too long

What happend here? I didnot see a limitation on the useragent side. This is because most of the browsers support more number of cookies than in the original specification. But what happend then? It is self explanatory from the message, right? Size of the request header is too long! Almost all of the servers have a way to set this size limit per header. For example, microsoft IIS server has way to cofigure "MaxFieldLength" property, which sets the upper limit for each header. See the details here: http://support.microsoft.com/kb/820129

Default value for MaxFieldLength in IIS is 16 bytes. So if you tries to send cookies with total size more than 16 bytes, server will give 400 status code back. I did the same experiment with an Apache server, for which the default limit is found as 8 bytes, which is, of course, cofigurable based of your requirement.

Now, I just want you all to be a little careful while using cookies. Because if you ever allow your code to create cookies with total size more than the minimum size set by the server, then you are in trouble, you will be kicking your user out of the site. Specially if they are persistant cookies, most of the ordinary users doesn't understand what this message mean, and they will not clean the cookie and continue with the site. So be careful with your cookies and have a safe coding ahead!