Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies.

Although this is a user/browser-side DOS, I'm wondering how one would stop this on the server-side.


Most browsers have a limit on how many cookies they'll store for a single TLD. So, if the server is configured to allow a sufficiently large request to include all these cookies, the requests won't be rejected anymore. Apache has options like LimitRequestFields, LimitRequestFieldSize, etc. Setting these sufficiently high should allow the request to be processed with all the attacker-added cookies, though at a memory and processing time cost.

Of course, if you control the entire domain, there's other mitigations possible, since it requires that an attacker is able to author content that sets cookies on *.targetdomain.com, it is only possible to exploit with attacker-controlled content on that domain. So if attackers are not allowed to create server-side scripts (i.e., anything that can send Set-Cookie) or craft JavaScript (that can set cookies via document.cookie) then you'd be vulnerable. So clearly, the mitigation is not allowing users to create content on those domains.


You really can't.

The issue is that the cookies are client-side and there are only two methods to fix the problem: ignore/accept the cookies or delete them.

The former is probably easier than the latter, but I would not recommend it. There's a reason to keep cookies small -- they're not the full meal. (Why on earth would a server want to accept a half-megabyte cookie header...? Most web pages are only 2MB or so.) So, yes, you can ignore or accept whatever size header the client sends you, but that's bad practice.

You could delete the cookies with your own JS, but that's only possible if you know the cookie's name, domain, and path. And while you might be able to clear all the cookies for your domain, you'd run into two issues: (1) You'd remove all your other cookies, unless you had some really good JavaScript, and (2) you'd only remove cookies for your domain -- missing the other blocked sites.

edit: read David's answer because he mentions on not letting users write custom JS for your site which I skipped over.

Good reads: Maximum on http header values? and How can I delete all cookies with JavaScript?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.