Internet Explorer increases cookie limit to 50

Posted by Gavin Terrill on Sep 03, 2007 01:46 PM

Community

Architecture

Topics

Javascript,

Security

Tags

Firefox,

Internet Explorer

Microsoft has released an update to Internet Explorer that increases the number of cookies allowed per domain from 20 to 50, equivalent to FireFox. Eric Lawrence, Program Manager at Microsoft and the man behind the Fiddler HTTP debugging proxy, wrote about the release:

In the past, IE’s cookie jar stored a maximum of 20 cookies per domain. If more than 20 cookies were sent by the server, older cookies were automatically dropped by the browser. The dropped cookies could lead to lost website settings, an empty web shopping basket, or similar problems.

The 20 cookie limit dates back to the original Netscape preliminary specification: Client Side State - HTTP Cookies. While an increase to 50 cookies for Internet Explorer may sound like an improvement, there are significant performance implications when you take into account the increased request size and slower upload speeds:

Unfortunately, cookies can dramatically impact the size of HTTP requests, slowing down the user’s browsing experience significantly.  Many of today’s web users have connections with asymmetrical bandwidth, having download speeds 2 to 5 times faster than their upload speeds.  This means that in some cases, HTTP request size is a more important factor than the size of the server’s response in determining overall transfer time.

Eric offers three strategies to deal with these implications:

1. minimize the size of your cookies - for example by using shorter variable names.
   
2. deliver static content from a different domain - so that the cookies are not sent in the request.
   
3. minimize the size of your cookies - where you limit cookies based on path:

   The last strategy is similar to the second, except that you can undertake it with just one domain.  If you can keep all of your pages that need access to cookies within a single path (e.g. http://example.com/webapp/) you can use the Path attribute on the cookie to specify that the cookie should only be sent for requests within that path. This will ensure that requests sent outside of that path (e.g. http://example.com/images/) are not forced to carry unneeded cookies.

Eric also suggests restricting cookie access from client side scripts to help mitigate Cross Site Scripting attacks:

If your cookies are only used by your server, and your scripts don’t require access to your cookies, use the HttpOnly attribute to help protect your site against cookie theft via cross-site scripting attacks

The HttpOnly attribute was introduced in Internet Explorer 6 SP1. It will also be supported in Firefox 3, and is available as a FireFox Add-On now.

1. Back to top

   Nice Article

   Dec 24, 2007 3:45 AM by Genckolik Karahan

   Thanks Job, This is very nice article, http://www.genckolik.net

   Reply

2. Back to top

   nice

   Dec 27, 2007 12:59 PM by xfiles keyfici

   thank you very much. great work & article. keyfi müzik keyfi müzik arşiv keyfi müzik tags keyfi müzik keyfi müzik sitemaps

   Reply

3. Back to top

   Internet Explorer increases cookie limit to 50

   Feb 13, 2008 10:48 PM by ilkay cevik

   These cookices are leading sometimes very big problem. For example: joomla cb login problem. Thanks from: Overcoming Stress
   Depression Medication
   Mortgage Refinancing
   Mortgage Calculator
   
   
   

   Reply

4. Back to top

   ie

   Feb 25, 2008 6:06 PM by admiral alican

   whatever ie does i don't think they ll be good or better than firefox vizyon filmleri

   Reply

5. Back to top

   Re: good

   Jun 3, 2008 11:32 AM by ilkay cevik

   I've been working with selenium since last year and it´s great for web test. It´s true that ajax have been a problem for selenium but the extensibility allows anything. The posibility of implemet new commands have allowed me, and my company, to solve the problems implementing personalized comands. Selenium: It works... and if it doesn´t you could make it work! Thanks from:

   Las Vegas Entertainment
   

   Stress Management
   

   Best Web Hosting
   

   Reply

• Older >