Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A application bug caused us to set a cookie that's too large.

Clients get an error that happens prior to our application being executed (mod_python).

Are there any adjustable limits within apache for how large a cookie header can be ?

Within apache error logs, I'm seeing: request failed: error reading the headers

share|improve this question
add comment

2 Answers 2

See the LimitRequestLine directive in Apache's configuration. The default is 8190 so anything bigger than that has the potential to cause problems.

This directive sets the number of bytes that will be allowed on the HTTP request-line.

The LimitRequestLine directive allows the server administrator to reduce or increase the limit on the allowed size of a client's HTTP request-line. Since the request-line consists of the HTTP method, URI, and protocol version, the LimitRequestLine directive places a restriction on the length of a request-URI allowed for a request on the server. A server needs this value to be large enough to hold any of its resource names, including any information that might be passed in the query part of a GET request.

This directive gives the server administrator greater control over abnormal client request behavior, which may be useful for avoiding some forms of denial-of-service attacks.

I believe this is the limit of the sum of all cookies on a web page and not just an individual cookie (not positive on that though). But all the cookies for a website are transmitted using the a single request header, so if enough cookies are on a webpage and the sum exceeds the value of the LimitRequestLine directive, there will be problems.

share|improve this answer
    
Actually, I think for cookies we want 'LimitRequestFieldSize' right ? –  rhettg Jul 23 '10 at 20:13
1  
Yep it can also help, but keep in mind that LimitRequestLine sets the overall Request size, containing all the fields. so you cannot have a Field size (or LimitRequestFieldSize) > LimitRequestLine. –  Weboide Jul 23 '10 at 20:56
    
Also worth mentioning that to set it higher then default you need to rebuild the source, the docs states: "Also, you can't set this higher than 8190 without modifying the source and rebuilding." –  Radu Maris Aug 6 '13 at 11:35
add comment

You can use plugin that store multiple values in a single cookie.

https://github.com/pavelkukov/localdata

Apache default limit for size of get request is 8k - two full cookies.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.