ory/hydra · error

cookiex: encoded cookie %q exceeds %d bytes

Error message

cookiex: encoded cookie %q exceeds %d bytes

What it means

Returned by Codec.Set after sealing succeeds but the base64-encoded ciphertext plus envelope exceeds the browser cookie size limit (maxCookieValueLength, ~4KB). The caller is storing too much data in a single cookie; the value itself encrypted fine.

Source

Thrown at oryx/cookiex/cookiex.go:203

	return zero, errors.WithStack(ErrInvalidCookie)
}

// Set seals value into cookie.Value and writes the cookie to w. All other
// attributes (name, path, domain, max-age, secure, http-only, same-site) must
// be set by the caller on the cookie.
func (c *Codec[T]) Set(w http.ResponseWriter, cookie *http.Cookie, value T) error {
	var encoded string
	var err error
	if c.legacy.encode {
		encoded, err = c.sealLegacy(cookie.Name, value)
	} else {
		encoded, err = c.seal(cookie.Name, value)
	}
	if err != nil {
		return err
	}
	if len(encoded) > maxCookieValueLength {
		return errors.Errorf("cookiex: encoded cookie %q exceeds %d bytes", cookie.Name, maxCookieValueLength)
	}
	cookie.Value = encoded
	http.SetCookie(w, cookie)
	return nil
}

// Get returns the value of the first cookie named name that decodes. It
// returns http.ErrNoCookie when no cookie with that name is present, and
// ErrInvalidCookie when none of the present values decode.
func (c *Codec[T]) Get(r *http.Request, name string) (T, error) {
	return c.GetMatching(r, name, nil)
}

// GetMatching returns the value of the first cookie named name that decodes
// and matches. Requests can carry multiple cookies with the same name, for
// example one from a parent and one from a sub domain; match selects among
// them. A nil match matches any value. It returns http.ErrNoCookie when no
// cookie with that name is present, and ErrInvalidCookie when none of the

View on GitHub (pinned to 4174065ffb)

Solutions

1. Move large state server-side (session store/database) and keep only an ID in the cookie
2. Reduce the payload stored in the cookie to essential fields
3. Split data across multiple cookies only as a last resort

When it happens

Trigger: Thrown at oryx/cookiex/cookiex.go:203 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/022d0f503aabf900. Report an issue: GitHub.