Http11Probe

Many Pairs β€” Cookie Handling

Test ID COOK-MANY-PAIRS
Category Cookies
Scored No
RFC Level N/A
Expected 2xx or 400/431

What it sends

1000 cookie key=value pairs β€” tests parser performance limits.

GET /echo HTTP/1.1\r\n
Host: localhost:8080\r\n
Cookie: k0=v0; k1=v1; ... k999=v999\r\n
\r\n

Why it matters

A large number of cookie pairs can cause O(n^2) parsing behavior, hashtable flooding, or memory exhaustion in frameworks that eagerly parse all cookies.

Verdicts

  • Pass β€” 2xx or 400/431
  • Fail β€” 500 (crash)

Sources

Http11Probe β€” HTTP/1.1 compliance & smuggling testerSource on GitHub