Why is PHP ignoring all cookies after the first 10

Question

I know I shouldn't be storing so many cookies in my users' browsers. And I'm working on reducing the number. But still I want to know the answer to this. The browser is sending 120 cookies. I can see all of them when I view the request using dev tools. But in PHP when I examine the $_COOKIE variable, there are only 100. To make matters worse, one of the cookies that isn't getting through is the PHPSESSID, and so sessions aren't working at all.

Every Google result tells me that cookie limits are enforced by browsers, not by servers. And like I said, the browser is sending all the cookies. It's the server that's messing things up. The same thing is happening in Chrome, Firefox and IE: if I send >100 cookies, the size of $_COOKIE is exactly 100.

These are not big cookies, either - each one is 6 characters, so it's a total of 600 bytes of cookie content that's making it through to PHP.

I have tried varying the names of the cookies, and the number of cookies, and no matter what I do, the number of cookies in $_COOKIE is 100.

Answer 1

I wouldn't go over 50 cookies for each domain if you want to support all browsers.

If you want to support most browsers, then don't exceed 50 cookies per domain, and don't exceed 4093 bytes per domain!

Max Cookie Count Per Domain is calculated by adding cookies until the number of cookies saved stops increasing.

Max Cookie Size Per Cookie is calculated by increasing the cookies value one character at a time, until the saved value is truncated.

Max Cookie Size Per Domain is guessed by adding cookies of maximum size, until no more cookies can be added. Hence, the actual limit may be more than the guessed limit. Guessed Limit <= Actual Limit < Guessed Limit + Max CookieSize.

Typically, the following are allowed:

• 300 cookies in total.

• 4096 bytes per cookie.

• 20 cookies per domain.

• 81920 bytes per domain*.

• Given 20 cookies of max size 4096 = 81920 bytes.

IE (and Opera) introduces a new limit, max bytes per domain.

Source: http://browsercookielimits.squawky.net/