Re: [http-state] Updated draft

[Bil Corry <[e-mail]>]

Adam Barth wrote on 8/15/2009 6:42 PM: 
>> Is that really a MUST? There's no fixed 50 cookies limit in curl at least
>> and I would be surprised if all other HTTP clients would agree on this. May
>> I suggest that to be written a MAY instead?
> 
> Done.  I have it on good authority that there exist sites that break
> if you change this number.  However, I've softened the draft to make
> 50 only a suggestion.

A bit dated, Nicholas Zakas of Yahoo! talks about the maximum number of cookies[1]:

---8<---
    * Microsoft indicated that Internet Explorer 8 increased the cookie limit per domain to 50 cookies but I’ve found that IE7 also allows 50 cookies per domain. Granted, this may have been increased with a system patch rather than having the browser’s first version ship like this, but it’s still more than the 20 that was commonly understood to be the limit.
    * Firefox has a per-domain cookie limit of 50 cookies.
    * Opera has a per-domain cookie limit of 30 cookies.
    * Safari/WebKit is the most interesting of all as it appears to have no perceivable limit through Safari 3.1. I tested setting up to 10,000 cookies and all of them were set and sent along in the Cookie header. The problem is that the header size exceeded the limit that the server could process, so an error occurred.
--->8---


He also mentions differences in cookie eviction:

---8<---
   1. The least recently used (LRU) approach automatically kicks out the oldest cookie when the cookie limit has been reached in order to allow the newest cookie some space. Internet Explorer and Opera use this approach.
   2. Firefox does something strange: it seems to randomly decide which cookies to keep although the last cookie set is always kept. There doesn’t seem to be any scheme it’s following at all. The takeaway? Don’t go above the cookie limit in Firefox.
--->8---


And differences in cookie size support (although this conflicts with results Daniel Stenberg posted earlier[2]):

---8<---
    * Firefox and Safari allow cookies with up to 4097 characters, that’s 4096 for the name and value and one for the equals sign.
    * Opera allows cookies with up to 4096 characters, which is for the name, value, and equals sign.
    * Internet Explorer allows cookies with up to 4095 characters, which is for the name, value and, equals sign.
--->8---



- Bil

[1] http://www.nczonline.net/blog/2008/05/17/browser-cookie-restrictions/
[2] http://www.ietf.org/mail-archive/web/http-state/current/msg00115.html