nextjs - 💡(How to fix) Fix Throw an error if cookie max length is exceeded [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
vercel/next.js#85008Fetched 2026-04-08 02:17:44
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Participants
Timeline (top)
issue_type_added ×1labeled ×1

Error Message

Expected behavior: The application should throw an exception when attempting to set a cookie that exceeds size limits, making the issue immediately apparent during development or testing. Actual behavior: The cookie is silently not set, and middleware cannot access it without any error or warning.

Root Cause

We spent 7 hours debugging with the WorkOS team helping us remotely until we figured this out. We found this because we're building a marketplace integration usnig the WorkOS Vercel OAuth integration (which is the one that sends a huge access token that we need to save as a cookie). We worked around it by removing the avatar url which is pretty big.

Code Example

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.0.0: Mon Aug 12 20:52:12 PDT 2024; root:xnu-11215.1.10~2/RELEASE_ARM64_T6020
  Available memory (MB): 16384
  Available CPU cores: 12
Binaries:
  Node: 22.11.0
  npm: 10.9.0
  Yarn: N/A
  pnpm: 10.13.1
Relevant Packages:
  next: 15.5.6 // Latest available version is detected (15.5.6).
  eslint-config-next: N/A
  react: 19.1.0
  react-dom: 19.1.0
  typescript: 5.9.3
Next.js Config:
  output: N/A
RAW_BUFFERClick to expand / collapse

Link to the code that reproduces this issue

https://github.com/tomaspiaggio/big-cookie-nextjs-repro

To Reproduce

  1. Clone this repository
  2. Make a GET request to the /set-cookie route. It'll set a large cookie (5000 characters).
  3. Observe that the middleware logs "Cookie not found" instead of reading the cookie.

Current vs. Expected behavior

When a cookie larger than the standard 4KB limit is set via a route handler on Next, the cookie does not appear in the middleware's request.cookies object. This silent failure can lead to unexpected behavior in applications that rely on middleware to process cookies.

Expected behavior: The application should throw an exception when attempting to set a cookie that exceeds size limits, making the issue immediately apparent during development or testing.

Actual behavior: The cookie is silently not set, and middleware cannot access it without any error or warning.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.0.0: Mon Aug 12 20:52:12 PDT 2024; root:xnu-11215.1.10~2/RELEASE_ARM64_T6020
  Available memory (MB): 16384
  Available CPU cores: 12
Binaries:
  Node: 22.11.0
  npm: 10.9.0
  Yarn: N/A
  pnpm: 10.13.1
Relevant Packages:
  next: 15.5.6 // Latest available version is detected (15.5.6).
  eslint-config-next: N/A
  react: 19.1.0
  react-dom: 19.1.0
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Cookies

Which stage(s) are affected? (Select all that apply)

next dev (local), Vercel (Deployed)

Additional context

<img width="217" height="231" alt="Image" src="https://github.com/user-attachments/assets/1611bb95-9a97-46d7-b358-ecf1e87a1315" />

We spent 7 hours debugging with the WorkOS team helping us remotely until we figured this out. We found this because we're building a marketplace integration usnig the WorkOS Vercel OAuth integration (which is the one that sends a huge access token that we need to save as a cookie). We worked around it by removing the avatar url which is pretty big.

extent analysis

TL;DR

The issue can be fixed by handling cookie size limits, potentially by throwing an exception when attempting to set a cookie that exceeds the standard 4KB limit.

Guidance

  • Review the Next.js documentation to understand how to handle large cookies, as the current implementation silently fails when setting cookies larger than 4KB.
  • Consider modifying the code to check the size of the cookie before setting it and throw an exception if it exceeds the limit, making the issue immediately apparent during development or testing.
  • Investigate alternative solutions for storing large data, such as using a different storage mechanism or compressing the data before storing it as a cookie.
  • Verify that the workaround of removing the avatar URL, which is currently being used, is a viable long-term solution or if a more robust fix is needed.

Example

No code snippet is provided as the issue does not explicitly state the code that sets the cookie, but an example of checking cookie size before setting it might look like:

const maxSize = 4096; // 4KB limit
const cookieValue = '...'; // value to be set as a cookie
if (cookieValue.length > maxSize) {
  throw new Error('Cookie value exceeds the maximum allowed size');
}
// set the cookie

Notes

The provided information suggests that the issue is specific to Next.js and its handling of large cookies. The workaround of removing the avatar URL may not be suitable for all use cases, and a more robust solution may be needed.

Recommendation

Apply a workaround, such as checking the cookie size before setting it and throwing an exception if it exceeds the limit, to handle large cookies and prevent silent failures. This approach allows for immediate detection of issues during development or testing.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

nextjs - 💡(How to fix) Fix Throw an error if cookie max length is exceeded [1 participants]