angular/angular.js · warning

Cookie '{}' possibly not set or overflowed because it was to

Error message

Cookie '{}' possibly not set or overflowed because it was too large ({} > 4096 bytes)!

What it means

ngCookies' cookieWriter builds the full Set-Cookie string (name=value plus escaped value, path, domain, expiry, secure, samesite) and checks its length against 4096 bytes — the RFC 2109 minimum every browser must support. It still assigns the cookie, but warns via $log.warn that the browser may silently drop or overflow it, so the cookie 'possibly' did not stick. This is a warning, not a thrown exception.

Source

Thrown at src/ngCookies/cookieWriter.js:44

    }
    if (angular.isString(expires)) {
      expires = new Date(expires);
    }

    var str = encodeURIComponent(name) + '=' + encodeURIComponent(value);
    str += path ? ';path=' + path : '';
    str += options.domain ? ';domain=' + options.domain : '';
    str += expires ? ';expires=' + expires.toUTCString() : '';
    str += options.secure ? ';secure' : '';
    str += options.samesite ? ';samesite=' + options.samesite : '';

    // per http://www.ietf.org/rfc/rfc2109.txt browser must allow at minimum:
    // - 300 cookies
    // - 20 cookies per unique domain
    // - 4096 bytes per cookie
    var cookieLength = str.length + 1;
    if (cookieLength > 4096) {
      $log.warn('Cookie \'' + name +
        '\' possibly not set or overflowed because it was too large (' +
        cookieLength + ' > 4096 bytes)!');
    }

    return str;
  }

  return function(name, value, options) {
    rawDocument.cookie = buildCookieString(name, value, options);
  };
}

$$CookieWriter.$inject = ['$document', '$log', '$browser'];

angular.module('ngCookies').provider('$$cookieWriter', /** @this */ function $$CookieWriterProvider() {
  this.$get = $$CookieWriter;
});

View on GitHub (pinned to d8f77817eb)

Solutions

1. Store only a compact session/id key in the cookie and keep the payload server-side or in localStorage/sessionStorage.
2. Shrink the payload: drop redundant fields, shorten keys, or compress before putObject.
3. Trim cookie attributes (omit path/domain/samesite when the defaults suffice) to reclaim bytes — but treat the value itself as the main budget.

Example fix

// before
$cookies.putObject('profile', user); // serialized JSON > 4096 bytes -> warn

// after
var sessionId = Session.create(user); // server stores the profile
$cookies.put('sid', sessionId);        // small opaque key instead

// Check the encoded size before writing the cookie
function cookieSizeOk(name, value) {
  return encodeURIComponent(name).length +
         encodeURIComponent(value).length + 1 <= 4096;
}
if (cookieSizeOk('profile', json)) {
  $cookies.put('profile', json);
} else {
  $cookies.put('profileId', id); // small key; payload lives elsewhere
}

When it happens

Trigger: $cookies.put(key, bigString) or $cookies.putObject(key, largeObject) whose serialized, URI-escaped form plus cookie attributes exceeds 4096 bytes; large values combined with long domain/path/expiry/samesite options eating into the budget (the check is str.length + 1).

Common situations: Storing JSON session state (user profile, preferences, shopping cart) directly in a cookie; putting a long JWT plus its attributes into one cookie; encoding non-Latin text whose escape sequences triple the size; cookies that work in one browser but vanish in another because implementations cap at exactly 4096.

AI-assisted analysis of angular/angular.js@d8f77817eb (2026-08-21). Data as JSON: /api/errors/5b5b2c3ea995c7c1. Report an issue: GitHub.