2 ms·

warning: article is from 2008, and is an advance ad for a book that hasn't been published yet. cookies are limited to 4K (not enforced uniformly by browsers) a

by gregjor 16y ago

warning: article is from 2008, and is an advance ad for a book that hasn't been published yet. cookies are limited to 4K (not enforced uniformly by browsers) and the total number of cookies and the number from any single domain are also (theoretically) restricted. server-side sessions don't have these limits (or don't have to). author seems unaware of this when he espouses cookies instead of sessions. he also doesn't address the obvious security problems of maintaining state in cookies and form fields, where anyone can fiddle with it.

masklinn 16y ago
> and the total number of cookies and the number from any single domain are also (theoretically) restricted Did you mean "practically"? From what I've seen, HTTP specs generally don't set limits (so I would not expect any for cookies), and RFC 2965 is no different: it only sets a lower bound (300 cookies, 20 cookies per unique host or domain, 4k per cookie). Theoretically (from a strict RFC reading), almost nothing in HTTP is restricted, but implementations tend to disagree at every single level of resolution (and some do pretty damn early)