Understanding Cookie Sizing and Chunking: A Supabase Dilemma

Search for a command to run...

No comments yet. Be the first to comment.
I've been using Claude Code as my primary development tool for months now. I joke that my job is essentially managing Claude Codes, but it's not far from the truth. Understanding Code with Claude Claude Code helps me write code and acts as a reasonin...
[All opinions are my own] I've been using Claude Code a lot lately, and I continue to be both amused and impressed at how well its grep-based agentic search works. It seemed counterintuitive to me at first. RAG (Retrieval-Augmented Generation) is oft...
I applied to five jobs. Just five. Everyone told me I was doing it wrong. "You need to cast a wider net," they said. "It's a numbers game." But that approach has never worked for me. It's exhausting and inefficient. About six weeks into my new job, I...
As I was transitioning from being a startup founder back into the job market, I felt this weird mix of being overwhelmed with options yet somehow underwhelmed at the same time. Coming from founding a startup after working at both early-stage companie...
I’ve learnt some valuable lessons during my journey as a founder trying to find product-market fit (PMF). I'm sharing some key takeaways and documenting this so I can reference it as I keep building. Most, if not all, of this is relevant only to B2B ...
While working on our app (at Nexel), we encountered a peculiar bug with Supabase where it was generating duplicate auth cookies - one chunked and the other not. This bug led me to explore cookie sizing and chunking in order to understand why one cookie was chunked and the other not. Although I won't delve into the bug's specifics here, those curious about it can find more information in the Github issue.
An HTTP Cookie, also known as a web or browser cookie, is a small piece of data sent from a server to the user's web browser. The browser may store it and send it back with subsequent requests to the same server. Cookies are primarily used to recognize requests from the same browser, facilitating functionalities like session management (user logins, shopping carts etc.), personalization, and tracking.
Size Matters
The size of a cookie is not determined by the length of its content (like I had wrongly assumed) but by the space it occupies, capped at 4,096 bytes (4KB). This includes the cookie's name, value, and attributes. This means the auth cookie Supabase generates has to be within this limit.
Supabase was generating three cookies named: sb-prefix-auth-token, sb-prefix-auth-token.0 and sb-prefix-auth-token.1.
sb-prefix-auth-token was a single cookie that contained all the necessary auth information. While sb-prefix-auth-token.0 and sb-prefix-auth-token.1 had the auth information split between them. Their sizes were 3,216 bytes and 244 bytes, totaling 3,460 bytes - well within the 4KB limit. This raised the question: Why were they chunked if they didn't exceed the size limit?
Upon investigation, I found that Supabase sets its maximum chunk size to 3,180 bytes[1]. However, the reasoning behind this specific limit remains unclear, as there's no documentation or discussion in their codebase explaining this choice. Interestingly, this limit was initially set higher at 3,600 bytes before being reduced to 3,180 bytes shortly after.
I wondered if this is related to browser limitations, but a quick search revealed that most browsers support cookies of at least 4KB. So, the mystery continues.
Well, I could keep digging but that’s as far down the rabbit hole as time allows. If anyone has insights into Supabase's decision to chunk cookies at less than 4KB, I'd love to hear from you!
A Note on Cookie Chunking
It's worth mentioning that the .0 and .1 suffixes in the cookie names serve a practical purpose - they indicate the order in which the cookie chunks should be merged, with .0 preceding .1.
Learn more about cookies here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies