Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A application bug caused us to set a cookie that's too large.

Clients get an error that happens prior to our application being executed (mod_python).

Are there any adjustable limits within apache for how large a cookie header can be ?

Within apache error logs, I'm seeing: request failed: error reading the headers

share|improve this question

See the LimitRequestLine directive in Apache's configuration. The default is 8190 so anything bigger than that has the potential to cause problems.

This directive sets the number of bytes that will be allowed on the HTTP request-line.

The LimitRequestLine directive allows the server administrator to reduce or increase the limit on the allowed size of a client's HTTP request-line. Since the request-line consists of the HTTP method, URI, and protocol version, the LimitRequestLine directive places a restriction on the length of a request-URI allowed for a request on the server. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the query part of a GET request.

This directive gives the server administrator greater control over abnormal client request behavior, which may be useful for avoiding some forms of denial-of-service attacks.

I believe this is the limit of the sum of all cookies on a web page and not just an individual cookie (not positive on that though). But all the cookies for a website are transmitted using the a single request header, so if enough cookies are on a webpage and the sum exceeds the value of the LimitRequestLine directive, there will be problems.

share|improve this answer
Actually, I think for cookies we want 'LimitRequestFieldSize' right ? – rhettg Jul 23 '10 at 20:13
Yep it can also help, but keep in mind that LimitRequestLine sets the overall Request size, containing all the fields. so you cannot have a Field size (or LimitRequestFieldSize) > LimitRequestLine. – Weboide Jul 23 '10 at 20:56
Also worth mentioning that to set it higher then default you need to rebuild the source, the docs states: "Also, you can't set this higher than 8190 without modifying the source and rebuilding." – Radu Maris Aug 6 '13 at 11:35

You can use plugin that store multiple values in a single cookie.

Apache default limit for size of get request is 8k - two full cookies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.