Maximum Cookie Size of current browsers (Year 2018)

Question

From the django docs:

Both RFC 2109 and RFC 6265 state that user agents should support cookies of at least 4096 bytes. For many browsers this is also the maximum size.

Source: https://docs.djangoproject.com/en/2.1/ref/request-response/

Is this still valid today?

What is the maximum cookie size of current browsers?

Answer 1

The cookie spec definition in RFC6265 (April 2011) is the current RFC (No new draft and no new RFC) and is supported by all major browsers (IE,Chrome,Opera,Firefox) today.

• At least 4096 bytes for the entire cookie (as measured by the sum of all of the cookie names, values, and attributes).

• At least 50 cookies per domain, provided they don't go over the above limit.

• At least 3000 cookies total.

So all modern browsers support AT LEAST this. Any other limit values are a gamble

See 6.1. Limits in https://datatracker.ietf.org/doc/rfc6265/ for more details

Answer 2

You can test it out by setting and reading back a cookie size from JavaScript in an iteration if you are interested in modern browsers only.

That is what I was doing in the past. And this is exactly what this site is about, it also includes the limits by browsers.

But keep in mind that the matching cookies will travel with every HTTP requests so they could dramatically affect the perceived response time.