Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've read that it's best to serve static content (css, javascript, etc.) from a cookie-less domain or subdomain for better performance. I assume a domain is not cookie-less by default. How do I specify that I don't want to use cookies?

share|improve this question
3  
This kind of thing really doesn't matter unless you are serving thousands of pages an hour, or thousands of pages a minute. –  delete Jul 31 '10 at 4:44
    
"Despite doing our best to keep cookie size down, our use of Google Analytics puts the average user’s cookie size around 1 kilobyte." Useful and related - chrishateswriting.com/post/68794699432/small-things-add-up –  mvark Dec 4 '13 at 3:13
add comment

3 Answers

up vote 18 down vote accepted

When things like YSlow and Page Speed tell you to set up cookie-less domains, what they actually mean is serve media from a domain where you won't be setting any, or have not set any (globally) in the past. Sometimes this can be accomplished by using sub-domains, such as media.domain.com, or static.domain.com, however if you set a cookie on domain.com that applies to the domain as a whole – a cookie for *.domain.com – then this cookie will be sent by the client back to the server on every request for every domain associated with domain.com. This includes all sub-domains.

The global cookie becomes an issue if you decide to forgo the use of www. on your domains. Without a specific sub-domain to set a cookie for, all cookies must be set for *.domain.com in order for them to work.

This global cookie issue is why you will see static media served from places like ytimg.com on YouTube. ytimg.com will never serve dynamic content that can set cookies, which means no cookie for will ever be sent from the client back to the server when these domains are part of HTTP requests.

If you are certain that you will never have a cookie set for *.domain.com then you can use a sub-domain for your needs. Be aware that most of the time if you integrate with another site or service via Javascript, they will set global domain cookies.

In Apache (and I'm sure every other webserver) you can set or unset headers before requests are answered. This will not fix the issue of the client sending the cookie to your server, but it will keep your domains from ever sending or initially setting cookies. Only a problem if you serve content that isn't static from your cookie-less domains, which defeats their purpose.

Header unset Cookie
Header unset Set-Cookie 

This will unset the headers for existing cookies and for creating new cookies. Again, only an issue if you serve content from your static domains that could potentially set a cookie. Place this in your site or virtualhost's configuration (which depending on your OS, server, and version could be any number of places).

share|improve this answer
    
"Only a problem if you serve content that isn't static from your cookie-less domains, which defeats their purpose." - why, exactly? There's nothing about dynamically generated content that inherently requires cookies. –  delete Jul 31 '10 at 4:42
1  
I didn't say that serving the dynamic content from your static domain inherently set anything. I said that cookies would be a problem if you served dynamic content that set cookies from your static domain. The purpose of the static domain is to serve content that requires no interaction: images, css, js, etc. Dynamic content -- which is where your cookies should be set -- should not be handled by the static domain. –  Bryson Jul 31 '10 at 23:49
add comment

How do I specify that I don't want to use cookies?

It's not about what you need to do to have a cookieless domain - it's more about what you need to not do... To have a cookieless domain you have to make sure your application running on that domain doesn't set any cookies. This usually means not having logins, not having google analytics, not having sessions - i.e just serving media and nothing else. Obviously this depends on your setup.

One mistake I made recently was that I didn't make the distinction between a domain and a sub-domain. I started serving all my media from http://media.example.com thinking it was a cookieless domain but actually it is a sub-domain and I found many of my cookies from the main site http://www.example.com where being set at a domain level and therefore polluting my suppossedly cookieless sub-domain. Here is the link for how I solved that problem: http://serverfault.com/questions/160210/nginx-serve-static-content-from-a-cookieless-domain

share|improve this answer
1  
Cookies from www.example.net won't be sent to static.example.net, but cookies from example.net will be. The solution is to redirect example.net to www.example.net. –  TRiG Oct 28 '10 at 14:47
    
Thanks for the tip TRiG! –  Erwinus Jan 11 at 15:08
add comment

How do I specify that I don't want to use cookies?

You don't have to specify that you don't want to use cookies, you just don't use them.

share|improve this answer
2  
Not always an option. Javascript feature-integrations from other sites will usually set global cookies for the domain whether you want them or not. –  Bryson Jul 31 '10 at 3:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.