A solution for cookie size exceeded error: split the cookie into multiple smaller cookies and reconstruct them on the server side. This solution works especially well for serverless platforms without requiring additional infrastructure.
TL;DR: When your cookie size exceeds the 4KB browser limit, split it into multiple smaller cookies and reconstruct them on the server side. This solution works especially well for serverless platforms without requiring additional infrastructure.
In most of the Logto SDKs for traditional web apps, we store session data in HTTP-only cookies for security. Here's our approach:
When the SDK performs actions that require session data, it:
This approach requires no external storage and can be deployed directly to popular serverless platforms like Vercel without any additional infrastructure changes.
However, when implementing multi-organization support, we hit a limitation. Our cookie size grew beyond the 4KB browser limit because we needed to store:
This resulted in the error:
Browsers enforce strict cookie size limits, with most limiting individual cookies to 4KB and total cookie size to 8KB per domain.
Using external storage like Redis or a database would require additional infrastructure setup, increasing both costs and complexity for SDK users. This goes against our goal of providing a developer-friendly solution.
While in-memory storage could be an alternative, it doesn't work well for serverless environments where instances are ephemeral and memory is not shared between requests.
A simple solution is to split large cookies into smaller chunks. This article demonstrates the approach using Next.js as an example:
Cookie splitting offers an elegant solution that's both easy to implement and minimally disruptive to existing application architecture. By simply breaking down large cookies into smaller chunks, developers can overcome browser size limitations without changing their core session management approach or adding external dependencies.