Re: Replay attacks with cookie session

Brad Ediger
2007-03-23T18:43:19Z

On Mar 23, 2007, at 1:35 PM, Sandofsky wrote:

>
>> 80k cannot go in cookies. On most platforms the limit is 4k. The
>> CookieStore raises an error if you try to store too much.
>
> http://tools.ietf.org/html/rfc2109
>
> "at least 4096 bytes per cookie ... at least 20 cookies per unique
> host or domain name"
>
> Is there something in today''s cookie implementation that prevents
> someone from doing 20 cookies at 4k each?

I defer to my original statement:

>> The CookieStore raises an error if you try to store too much.

There is a hard-coded 4k limitation in the store, and the store will
only use one cookie per session.