1. 300 total cookies
2. 4 kilobytes per cookie, where the name and the OPAQUE_STRING combine to form the 4 kbyte limit.
3. 20 cookies per server or domain. (note that completely specified hosts and domains are treated as separate entities and have a 20 cookie limitation for each, not combined)

EXAMPLES

Second Example transaction sequence:
Assume all mappings from above have been cleared.
Client receives:
Set-Cookie: PART_NUMBER=ROCKET_LAUNCHER_0001; path=/
When client requests a URL in path "/" on this server, it sends:
Cookie: PART_NUMBER=ROCKET_LAUNCHER_0001
Client receives:
Set-Cookie: PART_NUMBER=RIDING_ROCKET_0023; path=/ammo
When client requests a URL in path "/ammo" on this server, it sends:
Cookie: PART_NUMBER=RIDING_ROCKET_0023; PART_NUMBER=ROCKET_LAUNCHER_0001
NOTE: There are two name/value pairs named "PART_NUMBER" due to the inheritance of the "/" mapping in addition to the "/ammo" mapping.

So What Is A Cookie? A cookie is a small piece of information that is sent by a web server to be stored on a web browser, so that it can later be read back from that browser the next time this unique visitor returns to that web server. This becomes useful for having the browser remember specific information about this visitor like location of their last visit, time spent, or user preferences (like style sheets). The cookie is a text file that is saved in the browser's directory and is stored in RAM while the browser is running. Also, the cookie may be stored on the computer's hard drive once you log off from the web site or web server.

What Are Cookies Used For? One use of cookies is for storing passwords and user ID's for specific web sites. The actual password may not be stored in the cookie per se, but a unique identifier for the user may be stored that can later be used to retrieve information from a database about the user. Also, they are used to store preferences of start pages. On sites with personalized viewing, your web browser will be requested to utilize a small amount of space on your computer's hard drive to store these preferences. That way, each time you log on to that web site, your browser will check to see if you have any pre-defined preferences (a cookie) for that unique server. If you do, the browser will send the cookie to the server along with your request for a web page. Microsoft and Netscape use cookies to create personal start pages on their web sites. Common uses for which companies utilize cookies, include:

• on-line ordering systems
• site personalization
• web site tracking.

Delphi and Cookies

procedure SetCookieField(Values: TStrings; const ADomain, APath: string;
   AExpires: TDateTime; ASecure: Boolean);

The method name SetCookieFields, may be a bit confusing initially. It pertains to the fact that this method sets the Cookie fields of the HTTP header. While building CGI/ISAPI using Delphi, we don't really work directly with the HTTP header even though we do have full access to it if we need it.

Another thing to understand is that each Name=Value pair is a cookie in and of itself. The method SetCookieFields, can set a whole list of cookies in one method call. But due to the nature of this, all cookies set will have the same path, domain, expiration date etc. This may not be what you want to do all the time. There will be times when you want to "expire" just one cookie or set just one cookie. The Method SetCookieFields can do that, but you need to explicitly create a TStrings derived object and free it.

To overcome this confusion/limitation, I find myself frequently using a function called SetCookie that allows me to set just one cookie and frees me from having to create a TStrings derived object (normally a TStringList) and free it. Besides, it keeps the code clean and readable. Similarly, I create a function called GetCookie that returns the Value (part of the Name=Value pair) of the given Name.

For further reading you might want to look at RFC 2109 that specifies Session State Management.