OWASPASVS 5.0 requirement

ASVS-V3.3.5 When the application writes a cookie, the cookie name and value length combined are not over 4096 bytes.

L3 Published 2025 Official page ↗
Standard
OWASP ASVS 5.0
Chapter
V3 Web Frontend Security
Section
V3.3 Cookie Setup
Level
L3 (requirement applies from this verification level up)

Requirement

Verify that when the application writes a cookie, the cookie name and value length combined are not over 4096 bytes. Overly large cookies will not be stored by the browser and therefore not sent with requests, preventing the user from using application functionality which relies on that cookie.