Number and size limits of a cookie in Internet Explorer (306070)

MORE INFORMATION

Each cookie begins with a name-value pair. This pair is followed by zero or by more attribute-value pairs that are separated by semicolons. For one domain name, each cookie is limited to 4,096 bytes. This total can exist as one name-value pair of 4 kilobytes (KB) or as up to 20 name-value pairs that total 4 KB. If the computer does not have sufficient space to store the cookie, the cookie is discarded. It is not truncated. Applications should use as few cookies as possible and as small a cookie as possible. Additionally, applications should be able to handle the loss of a cookie.

If a Web application uses more than 19 custom cookies, ASP session state may be lost. Internet Explorer 4.0 and later versions allow a total of 20 cookies for each domain. Because ASPSessionID is a cookie, if you use 20 or more custom cookies, the browser is forced to discard the ASPSessionID cookie and lose the session.

To store more than 20 name-value pairs for a domain, you can create a cookie dictionary by concatenating several name-value pairs for each cookie up to the 4,096-byte limit for that cookie. Currently, to retrieve these values from client-side scripting, you must parse the cookies manually. However, the Active Server Pages Request and Response objects include built-in functionality to work with cookie dictionaries as dictionary objects. The following sample code demonstrates the use of cookie dictionary in an ASP page:

<%
   Response.Cookies ("MyCookie")("a")="A"
   Response.Cookies ("MyCookie")("b")="B"   
   Response.Cookies ("MyCookie")("c")="C"
   Response.Cookies ("MyCookie")("d")="D"
   Response.Cookies ("MyCookie")("e")="E"
   Response.Cookies ("MyCookie")("f")="F"
   Response.Cookies ("MyCookie")("g")="G"
   Response.Cookies ("MyCookie")("h")="H"
   Response.Cookies ("MyCookie")("i")="I"
   Response.Cookies ("MyCookie")("j")="J"
   Response.Cookies ("MyCookie")("k")="K"
   Response.Cookies ("MyCookie")("l")="L"
   Response.Cookies ("MyCookie")("a1")="A"
   Response.Cookies ("MyCookie")("b1")="B"   
   Response.Cookies ("MyCookie")("c1")="C"
   Response.Cookies ("MyCookie")("d1")="D"
   Response.Cookies ("MyCookie")("e1")="E"
   Response.Cookies ("MyCookie")("f1")="F"
   Response.Cookies ("MyCookie")("g1")="G"
   Response.Cookies ("MyCookie")("h1")="H"
   Response.Cookies ("MyCookie")("i1")="I"
   Response.Cookies ("MyCookie")("j1")="J"
   Response.Cookies ("MyCookie")("k1")="K"
   Response.Cookies ("MyCookie")("l1")="L"
  
   Response.Cookies("MyCookie").Expires = "12/31/2001"


    For Each strKey In Request.Cookies
      Response.Write strKey & " = " & Request.Cookies(strKey) & "<BR><BR>"
      If Request.Cookies(strKey).HasKeys Then
        For Each strSubKey In Request.Cookies(strKey)
          Response.Write "->" & strKey & "(" & strSubKey & ") = " & _
            Request.Cookies(strKey)(strSubKey) & "<BR>"
        Next
      End If
    Next
%>

Note In Internet Explorer 5.0 and later, you can use the userData behavior to persist data across sessions. This behavior has a greater capacity than cookies.

If you use the document.cookie property to retrieve the cookie on the client side, the document.cookie property can retrieve only 4,096 bytes. This byte total can be one name-value pair of 4 KB, or it can be up to 20 name-value pairs that have a total size of 4 KB.

The document.getcookie function calls the CDocument::GetCookie method in Microsoft HTML. Microsoft HTML wrongly assumes that you are looking for a single cookie and that the size of the cookie cannot be greater than 4,096 bytes. The document.cookie property must be able to retrieve 20 cookies of 4,096 bytes each for Internet Explorer to be RFC compliant.
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

820536 Document.Cookie property returns an empty string

REFERENCES

For more information about the RFC 2109 specifications, see the following Web sites:

Internet Engineering Task Force (IETF)
http://www.ietf.org/rfc/rfc2109.txt

World Wide Web Consortium (W3C)
http://www.w3.org/Protocols/rfc2109/rfc2109

For more information about the Cookies collection, see the following Microsoft Developer Network (MSDN) Web site:

http://msdn.microsoft.com/library/en-us/iissdk/iis/ref_vbom_reqoccookie.asp

For more information about the userData behavior, see the following MSDN Web site:

http://msdn.microsoft.com/library/default.asp?url=/workshop/author/behaviors/reference/behaviors/userdata.asp

For more information about cookies, see the following Cookie Central Web site:

http://www.cookiecentral.com/

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

157906 How to maintain State across pages with VBScript

175167 How to store State in Active Server Pages applications

For more information about developing Web-based solutions for Microsoft Internet Explorer, visit the following Microsoft Web sites:

http://msdn.microsoft.com/ie/

http://support.microsoft.com/iep

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Number and size limits of a cookie in Internet Explorer (306070)

SUMMARY

MORE INFORMATION

REFERENCES