为何PHP会忽略第100个之后的所有Cookie？

Hey Dan, let's break down what's going on here—this is a super frustrating issue I've dealt with before, so I get how annoying it is when sessions fail because of missing cookies. Here's the root of the problem and how to fix it:

The Core Causes #

1. PHP's max_input_vars Limit #

PHP has a built-in setting called max_input_vars that caps the number of input variables it will process from any source (including cookies, POST data, and GET parameters). If your server's max_input_vars is set to 100 (way lower than the default 1000), PHP automatically truncates any variables beyond that number. That’s exactly why you only see 100 entries in $_COOKIE—the rest (including your critical PHPSESSID) get dropped entirely.

2. HTTP Request Header Size Limits #

Even if max_input_vars is configured correctly, web servers (like Apache or Nginx) have limits on how large individual request headers can be. All your cookies are sent in a single Cookie header string, and if that string exceeds the server’s allowed size, the server will chop off the end of the header. Since PHPSESSID is likely one of the last cookies in the list, it gets cut off before PHP ever has a chance to read it.

For reference:

• Apache’s default LimitRequestFieldSize is 8190 bytes
• Nginx uses client_header_buffer_size (default 1k) and large_client_header_buffers (default 4k) to control this

How to Fix It #

Short-Term Fixes #

1. Check and adjust max_input_vars

   • Add this line to your PHP code to see the current value:

     echo ini_get('max_input_vars');
     

   • If it’s set to 100, update your php.ini file (or .htaccess for per-directory settings) to a higher limit, like:

     max_input_vars = 500
     

   • Restart your web server to apply the change.

2. Adjust Server Header Size Limits

   • For Apache: Add or update LimitRequestFieldSize in your Apache config (httpd.conf or virtual host file):

     LimitRequestFieldSize 16384
     

   • For Nginx: Update your server block to increase header buffers:

     client_header_buffer_size 4k;
     large_client_header_buffers 4 8k;
     

   • Restart the server after making changes.

Long-Term Fix (The Best Approach) #

You’re already on the right track by reducing the number of cookies—this is the most sustainable solution. Here’s why:

• Too many cookies slow down every request (they add extra payload to every HTTP call)
• Browsers have their own limits (e.g., Chrome allows ~180 cookies per domain, with a total size cap of ~4KB)
• Merge multiple small cookies into one (using JSON serialization, for example) to cut down the count drastically
• Move non-essential data to localStorage or sessionStorage (note: these aren’t sent with every request, so only use them for client-side-only data)
• Consider using server-side storage (like Redis) for session data if you need to store more info without relying on cookies

内容的提问来源于stack exchange，提问作者Dan B.