# How much data can be stored in the cookie? **URL:** \ **Category:** Rails\ **Created:** [May 12, 2009, 11:13pm UTC](https://www.ruby-forum.com/t/how-much-data-can-be-stored-in-the-cookie/167820 "2009-05-12T23:13:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\ **Post date:** [May 12, 2009, 11:13pm UTC](https://www.ruby-forum.com/t/how-much-data-can-be-stored-in-the-cookie/167820/1 "2009-05-12T23:13:16Z")
I’ve looked online, but I can’t find a concrete answer to this. I’m considering storing some data in the user’s cookie, to be accessed by javascript. It’s not sensitive information, so security isn’t a problem. Altogether, I’m looking at two strings, one of which would be about 100 characters long, and the other closer to 1000 or 1500. Is that too much? Thanks! ---
**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\ **Post date:** [May 12, 2009, 11:34pm UTC](https://www.ruby-forum.com/t/how-much-data-can-be-stored-in-the-cookie/167820/2 "2009-05-12T23:34:45Z")
> I’ve looked online, but I can’t find a concrete answer to this. I’m > considering storing some data in the user’s cookie, to be accessed by > javascript. It’s not sensitive information, so security isn’t a > problem. > > Altogether, I’m looking at two strings, one of which would be about > 100 > characters long, and the other closer to 1000 or 1500. Is that too > much? Now, how well all the browsers honor this I dunno, but I’ve always seen the “4k” rule mentioned… > **[RFC 2965: HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc2965)** > > This document specifies a way to create a stateful session with Hypertext Transfer Protocol (HTTP) requests and responses. \[STANDARDS-TRACK\] 5.3 Implementation Limits Practical user agent implementations have limits on the number and size of cookies that they can store. In general, user agents’ cookie support should have no fixed limits. They should strive to store as many frequently-used cookies as possible. Furthermore, general-use user agents SHOULD provide each of the following minimum capabilities individually, although not necessarily simultaneously: - at least 300 cookies - at least 4096 bytes per cookie (as measured by the characters that comprise the cookie non-terminal in the syntax description of the Set- Cookie2 header, and as received in the Set-Cookie2 header) - at least 20 cookies per unique host or domain name User agents created for specific purposes or for limited-capacity devices SHOULD provide at least 20 cookies of 4096 bytes, to ensure that the user can interact with a session-based origin server. The information in a Set-Cookie2 response header MUST be retained in its entirety. If for some reason there is inadequate space to store the cookie, it MUST be discarded, not truncated. Applications should use as few and as small cookies as possible, and they should cope gracefully with the loss of a cookie. ---
**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\ **Post date:** [May 12, 2009, 11:49pm UTC](https://www.ruby-forum.com/t/how-much-data-can-be-stored-in-the-cookie/167820/3 "2009-05-12T23:49:57Z")
[http://api.rubyonrails.org/classes/ActionController/Session/CookieStore.html:](http://api.rubyonrails.org/classes/ActionController/Session/CookieStore.html:) This cookie-based session store is the Rails default. Sessions typically contain at most a user\_id and flash message; both fit within the 4K cookie size limit. Cookie-based sessions are dramatically faster than the alternatives. ---
**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\ **Post date:** [May 13, 2009, 12:02am UTC](https://www.ruby-forum.com/t/how-much-data-can-be-stored-in-the-cookie/167820/4 "2009-05-13T00:02:30Z")
Thanks you two. I’d found the 4kb limit, but wasn’t sure how that would come out in real-world usage - i.e., does Rails use up some of that space on its own, would the use of a secret and hash affect that… I also forgot to mention that I’m using Authlogic, which I believe would also take up some space.