Skip to content

fix: align MAX_COOKIE_SIZE with RFC 6265bis - #16322

Merged
Rich-Harris merged 3 commits into
sveltejs:mainfrom
Socialpranker:fix/13948-max-cookie-size
Jul 13, 2026
Merged

fix: align MAX_COOKIE_SIZE with RFC 6265bis#16322
Rich-Harris merged 3 commits into
sveltejs:mainfrom
Socialpranker:fix/13948-max-cookie-size

Conversation

@Socialpranker

@Socialpranker Socialpranker commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Fixes #13948

MAX_COOKIE_SIZE was set to 4129, a magic number that came from testing browser behavior rather than any spec. RFC 6265bis section 5.6 codifies 4096 bytes as the limit for a cookie's name and value combined, and that's what Chromium and Firefox actually enforce, so this changes the constant to 4096 and cites the spec in the comment.

While digging into this I noticed the existing check compared MAX_COOKIE_SIZE against the fully serialized Set-Cookie string, so name, value, and all the attributes like Path and SameSite. That doesn't match what 4096 is defined for in the spec (name + value only), so I changed the check itself to only measure the name and value, not the serialized string with its attributes. Keeping the scope to this since that's the simplest fix that matches the spec, per benmccann's comment on the issue about preferring the simplest solution.

Updated the existing dev-mode cookie size test to reflect the new 4096 boundary and added a case for a cookie right at the limit not throwing.

This PR was written with the help of Claude Code (Anthropic). I read through the issue thread, the relevant code, and verified the change and tests myself before opening this.

Ran pnpm -F @sveltejs/kit test:unit (598 passed), pnpm run format and eslint on the changed files, and tsc --noEmit for the kit package; all clean. Added a changeset (patch for @sveltejs/kit).

@Socialpranker @claude
fix: align MAX_COOKIE_SIZE with RFC 6265bis
0ac6348 
The 4129 byte limit was a magic number derived from ad hoc browser
testing rather than any spec. RFC 6265bis section 5.6 codifies 4096
bytes as the limit for a cookie's name and value combined, matching
what Chromium and Firefox actually enforce.

The existing check compared MAX_COOKIE_SIZE against the full
serialized Set-Cookie string (name, value, and attributes like Path
and SameSite), which doesn't match what 4096 measures in the spec. So
alongside bumping the constant, the check itself now only measures the
name/value pair instead of the fully serialized cookie.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@pkg-svelte-dev

pkg-svelte-dev Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Install the latest version of @sveltejs/kit from 1b735fd:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/1b735fd1c808ed1b91c255342237e0a4d2991926

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16322

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

@changeset-bot

changeset-bot Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 1b735fd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@sveltejs/kit Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel[bot]
vercel Bot reviewed Jul 10, 2026
View reviewed changes
Comment thread packages/kit/src/runtime/server/cookie.js Outdated
Rich-Harris
Rich-Harris approved these changes Jul 13, 2026
View reviewed changes

@Rich-Harris Rich-Harris left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you!

@Rich-Harris
Rich-Harris merged commit b557b1b into sveltejs:main Jul 13, 2026
23 of 24 checks passed
This was referenced Jul 13, 2026
Merged
Merged
teemingc pushed a commit that referenced this pull request Jul 13, 2026
@github-actions
Version Packages (#16316)
80b18f5 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @sveltejs/kit@2.69.3

### Patch Changes

- fix: detect destructured `load` and `actions` exports during type
generation ([#16329](#16329))

- fix: ensure CSS URL references are absolute when `paths.relative` is
`false` ([#16315](#16315))

- fix: align MAX_COOKIE_SIZE with RFC 6265bis
([#16322](#16322))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Rich-Harris pushed a commit that referenced this pull request Jul 14, 2026
@github-actions
Version Packages (next) (#16282)
1001947 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to version-3, this PR
will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

`version-3` is currently in **pre mode** so this branch has prereleases
rather than normal releases. If you want to exit prereleases, run
`changeset pre exit` on `version-3`.

⚠️⚠️⚠️⚠️⚠️⚠️

# Releases
## @sveltejs/kit@3.0.0-next.8

### Major Changes

- breaking: remove `experimental.handleRenderingErrors` flag
([#16265](#16265))

- breaking: make `getRequest` and `setResponse` synchronous
([#16280](#16280))

- breaking: make `page.url` immutable on a type level
([#16256](#16256))

- breaking: add `refreshAll` and deprecate `invalidateAll`
([#16289](#16289))

### Minor Changes

- feat: allow hyphens in param and matcher names
([#16284](#16284))

- feat: add `ErrorProps` to generated types
([#16272](#16272))

### Patch Changes

- fix: detect destructured `load` and `actions` exports during type
generation ([#16329](#16329))

- fix: ensure CSS URL references are absolute when `paths.relative` is
`false` ([#16315](#16315))

- fix: exclude deleted cookies from `cookies.getAll()` so it stays
consistent with `cookies.get()`
([#16297](#16297))

- fix: reset failed `<svelte:boundary>` on client navigation so a stale
`+error.svelte` is torn down
([#16296](#16296))

- fix: preserve shared client chunk hashes when the app version changes
([#16324](#16324))

- fix: align MAX_COOKIE_SIZE with RFC 6265bis
([#16322](#16322))

- fix: use mouseover+mousemove for preloading to reduce events
([#16325](#16325))
## @sveltejs/package@3.0.0-next.2

### Minor Changes

- feat: warn when using a `.server.` file or file inside a `server`
directory without importing a server-only module
([#16266](#16266))
## @sveltejs/adapter-auto@8.0.0-next.1

### Patch Changes

- fix: allow prerelease versions of SvelteKit 3 to satisfy the peer
dependency range ([#16286](#16286))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8
## @sveltejs/adapter-cloudflare@8.0.0-next.2

### Patch Changes

- fix: allow prerelease versions of SvelteKit 3 to satisfy the peer
dependency range ([#16286](#16286))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8
## @sveltejs/adapter-netlify@7.0.0-next.3

### Patch Changes

- fix: include `utils.js` in package.json `files`
([#16298](#16298))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8
## @sveltejs/adapter-node@6.0.0-next.3

### Patch Changes

- fix: allow prerelease versions of SvelteKit 3 to satisfy the peer
dependency range ([#16286](#16286))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8
## @sveltejs/adapter-static@4.0.0-next.1

### Patch Changes

- fix: allow prerelease versions of SvelteKit 3 to satisfy the peer
dependency range ([#16286](#16286))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8
## @sveltejs/adapter-vercel@7.0.0-next.2

### Patch Changes

- fix: allow prerelease versions of SvelteKit 3 to satisfy the peer
dependency range ([#16286](#16286))
- Updated dependencies
[[`737d119`](737d119),
[`fa78efb`](fa78efb),
[`07c207e`](07c207e),
[`a47071b`](a47071b),
[`14d7d5a`](14d7d5a),
[`5c38e51`](5c38e51),
[`0702baa`](0702baa),
[`e1938c6`](e1938c6),
[`8293144`](8293144),
[`f76d7d9`](f76d7d9),
[`ab5c253`](ab5c253),
[`b557b1b`](b557b1b),
[`4a513e2`](4a513e2)]:
  - @sveltejs/kit@3.0.0-next.8

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@Nic-Polumeyv Nic-Polumeyv mentioned this pull request Jul 14, 2026
Closed
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Jul 27, 2026
@renovate
⬆️ Update dependency @sveltejs/kit to ^2.70.1
12288c6 
##### [v2.70.1](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2701)

##### Patch Changes

- docs: update links to hooks documentation ([#16417](sveltejs/kit#16417))
##### [v2.70.0](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2700)

##### Minor Changes

- feat: move `defineEnvVars` to `@sveltejs/kit/env` ([#16378](sveltejs/kit#16378))

##### Patch Changes

- fix: enable CSRF protection in builds with a non-production `NODE_ENV` value ([#16313](sveltejs/kit#16313))
##### [v2.69.3](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2693)

##### Patch Changes

- fix: detect destructured `load` and `actions` exports during type generation ([#16329](sveltejs/kit#16329))

- fix: ensure CSS URL references are absolute when `paths.relative` is `false` ([#16315](sveltejs/kit#16315))

- fix: align MAX\_COOKIE\_SIZE with RFC 6265bis ([#16322](sveltejs/kit#16322))
renovate Bot added a commit to cigaleapp/cigale that referenced this pull request Jul 27, 2026
@renovate
⬆️ Update dependency @sveltejs/kit to ^2.70.1
cc4f843 
##### [v2.70.1](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2701)

##### Patch Changes

- docs: update links to hooks documentation ([#16417](sveltejs/kit#16417))
##### [v2.70.0](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2700)

##### Minor Changes

- feat: move `defineEnvVars` to `@sveltejs/kit/env` ([#16378](sveltejs/kit#16378))

##### Patch Changes

- fix: enable CSRF protection in builds with a non-production `NODE_ENV` value ([#16313](sveltejs/kit#16313))
##### [v2.69.3](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2693)

##### Patch Changes

- fix: detect destructured `load` and `actions` exports during type generation ([#16329](sveltejs/kit#16329))

- fix: ensure CSS URL references are absolute when `paths.relative` is `false` ([#16315](sveltejs/kit#16315))

- fix: align MAX\_COOKIE\_SIZE with RFC 6265bis ([#16322](sveltejs/kit#16322))
gwennlbh pushed a commit to cigaleapp/cigale that referenced this pull request Jul 27, 2026
@renovate
⬆️ Update dependency @sveltejs/kit to ^2.70.1 (#1996)
a6553b0 
##### [v2.70.1](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2701)

##### Patch Changes

- docs: update links to hooks documentation ([#16417](sveltejs/kit#16417))
##### [v2.70.0](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2700)

##### Minor Changes

- feat: move `defineEnvVars` to `@sveltejs/kit/env` ([#16378](sveltejs/kit#16378))

##### Patch Changes

- fix: enable CSRF protection in builds with a non-production `NODE_ENV` value ([#16313](sveltejs/kit#16313))
##### [v2.69.3](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2693)

##### Patch Changes

- fix: detect destructured `load` and `actions` exports during type generation ([#16329](sveltejs/kit#16329))

- fix: ensure CSS URL references are absolute when `paths.relative` is `false` ([#16315](sveltejs/kit#16315))

- fix: align MAX\_COOKIE\_SIZE with RFC 6265bis ([#16322](sveltejs/kit#16322))

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vercel vercel[bot] vercel[bot] left review comments
@Nic-Polumeyv Nic-Polumeyv Nic-Polumeyv left review comments
@Rich-Harris Rich-Harris Rich-Harris approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update MAX_COOKIE_SIZE

3 participants

@Socialpranker @Rich-Harris @Nic-Polumeyv