{"record":{"id":"022d0f503aabf900","repo":"ory/hydra","slug":"cookiex-encoded-cookie-q-exceeds-d-bytes","errorCode":null,"errorMessage":"cookiex: encoded cookie %q exceeds %d bytes","messagePattern":"cookiex: encoded cookie %q exceeds (.+?) bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/cookiex/cookiex.go","lineNumber":203,"sourceCode":"\treturn zero, errors.WithStack(ErrInvalidCookie)\n}\n\n// Set seals value into cookie.Value and writes the cookie to w. All other\n// attributes (name, path, domain, max-age, secure, http-only, same-site) must\n// be set by the caller on the cookie.\nfunc (c *Codec[T]) Set(w http.ResponseWriter, cookie *http.Cookie, value T) error {\n\tvar encoded string\n\tvar err error\n\tif c.legacy.encode {\n\t\tencoded, err = c.sealLegacy(cookie.Name, value)\n\t} else {\n\t\tencoded, err = c.seal(cookie.Name, value)\n\t}\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(encoded) > maxCookieValueLength {\n\t\treturn errors.Errorf(\"cookiex: encoded cookie %q exceeds %d bytes\", cookie.Name, maxCookieValueLength)\n\t}\n\tcookie.Value = encoded\n\thttp.SetCookie(w, cookie)\n\treturn nil\n}\n\n// Get returns the value of the first cookie named name that decodes. It\n// returns http.ErrNoCookie when no cookie with that name is present, and\n// ErrInvalidCookie when none of the present values decode.\nfunc (c *Codec[T]) Get(r *http.Request, name string) (T, error) {\n\treturn c.GetMatching(r, name, nil)\n}\n\n// GetMatching returns the value of the first cookie named name that decodes\n// and matches. Requests can carry multiple cookies with the same name, for\n// example one from a parent and one from a sub domain; match selects among\n// them. A nil match matches any value. It returns http.ErrNoCookie when no\n// cookie with that name is present, and ErrInvalidCookie when none of the","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/cookiex/cookiex.go#L185-L221","documentation":"Returned by Codec.Set after sealing succeeds but the base64-encoded ciphertext plus envelope exceeds the browser cookie size limit (maxCookieValueLength, ~4KB). The caller is storing too much data in a single cookie; the value itself encrypted fine.","triggerScenarios":"Thrown at oryx/cookiex/cookiex.go:203 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Move large state server-side (session store/database) and keep only an ID in the cookie","Reduce the payload stored in the cookie to essential fields","Split data across multiple cookies only as a last resort"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}