Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies.
Although this is a user/browser-side DOS, I'm wondering how one would stop this on the server-side.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Most browsers have a limit on how many cookies they'll store for a single TLD. So, if the server is configured to allow a sufficiently large request to include all these cookies, the requests won't be rejected anymore. Apache has options like
LimitRequestFieldSize, etc. Setting these sufficiently high should allow the request to be processed with all the attacker-added cookies, though at a memory and processing time cost.
Of course, if you control the entire domain, there's other mitigations possible,
since it requires that an attacker is able to author content that sets cookies on
You really can't.
The issue is that the cookies are client-side and there are only two methods to fix the problem: ignore/accept the cookies or delete them.
The former is probably easier than the latter, but I would not recommend it. There's a reason to keep cookies small -- they're not the full meal. (Why on earth would a server want to accept a half-megabyte cookie header...? Most web pages are only 2MB or so.) So, yes, you can ignore or accept whatever size header the client sends you, but that's bad practice.
edit: read David's answer because he mentions on not letting users write custom JS for your site which I skipped over.