Microsoft KB Archive/306070

= Number and size limits of a cookie in Internet Explorer =

Article ID: 306070

Article Last Modified on 8/15/2007

-

APPLIES TO


 * Microsoft Internet Explorer 4.0 128-Bit Edition
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 4.01 Service Pack 1
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 5.0
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer (Programming) 5.01 SP1
 * Microsoft Internet Explorer 5.5

-



This article was previously published under Q306070



SUMMARY
Microsoft Internet Explorer complies with the following RFC 2109 recommended minimum limitations:
 * at least 300 cookies
 * at least 4096 bytes per cookie (as measured by the size of the characters that comprise the cookie non-terminal in the syntax description of the Set-Cookie header)
 * at least 20 cookies per unique host or domain name

Note These recommended minimum limitations appear in RFC 2109, section 6.3, &quot;Implementation Limits.&quot; For more information, see the &quot;References&quot; section.



MORE INFORMATION
Each cookie begins with a name-value pair. This pair is followed by zero or by more attribute-value pairs that are separated by semicolons. For one domain name, each cookie is limited to 4,096 bytes. This total can exist as one name-value pair of 4 kilobytes (KB) or as up to 20 name-value pairs that total 4 KB. If the computer does not have sufficient space to store the cookie, the cookie is discarded. It is not truncated. Applications should use as few cookies as possible and as small a cookie as possible. Additionally, applications should be able to handle the loss of a cookie.

If a Web application uses more than 19 custom cookies, ASP session state may be lost. Internet Explorer 4.0 and later versions allow a total of 20 cookies for each domain. Because ASPSessionID is a cookie, if you use 20 or more custom cookies, the browser is forced to discard the ASPSessionID cookie and lose the session.

To store more than 20 name-value pairs for a domain, you can create a cookie dictionary by concatenating several name-value pairs for each cookie up to the 4,096-byte limit for that cookie. Currently, to retrieve these values from client-side scripting, you must parse the cookies manually. However, the Active Server Pages Request and Response objects include built-in functionality to work with cookie dictionaries as dictionary objects. The following sample code demonstrates the use of cookie dictionary in an ASP page: <%  Response.Cookies (&quot;MyCookie&quot;)(&quot;a&quot;)=&quot;A&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;b&quot;)=&quot;B&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;c&quot;)=&quot;C&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;d&quot;)=&quot;D&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;e&quot;)=&quot;E&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;f&quot;)=&quot;F&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;g&quot;)=&quot;G&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;h&quot;)=&quot;H&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;i&quot;)=&quot;I&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;j&quot;)=&quot;J&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;k&quot;)=&quot;K&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;l&quot;)=&quot;L&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;a1&quot;)=&quot;A&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;b1&quot;)=&quot;B&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;c1&quot;)=&quot;C&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;d1&quot;)=&quot;D&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;e1&quot;)=&quot;E&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;f1&quot;)=&quot;F&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;g1&quot;)=&quot;G&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;h1&quot;)=&quot;H&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;i1&quot;)=&quot;I&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;j1&quot;)=&quot;J&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;k1&quot;)=&quot;K&quot; Response.Cookies (&quot;MyCookie&quot;)(&quot;l1&quot;)=&quot;L&quot; Response.Cookies(&quot;MyCookie&quot;).Expires = &quot;12/31/2001&quot;

For Each strKey In Request.Cookies Response.Write strKey & &quot; = &quot; & Request.Cookies(strKey) & &quot;&quot; If Request.Cookies(strKey).HasKeys Then For Each strSubKey In Request.Cookies(strKey) Response.Write &quot;->&quot; & strKey & &quot;(&quot; & strSubKey & &quot;) = &quot; & _ Request.Cookies(strKey)(strSubKey) & &quot;&quot; Next End If   Next %> Note In Internet Explorer 5.0 and later, you can use the userData behavior to persist data across sessions. This behavior has a greater capacity than cookies.

If you use the document.cookie property to retrieve the cookie on the client side, the document.cookie property can retrieve only 4,096 bytes. This byte total can be one name-value pair of 4 KB, or it can be up to 20 name-value pairs that have a total size of 4 KB.

The document.getcookie function calls the CDocument::GetCookie method in Microsoft HTML.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

820536 Document.Cookie property returns an empty string

