Cookie-free subdomain

Question

I created a subdomain with redirects for my site images at images.domain.com in order to avoid cookies.

Based on my read of EE documentation, I should go to Admin / Security and Privacy / Cookie Settings and put .www.domain.com in the cookie domain box to set the cookies for that subdomain and that way avoid cookies for images.domain.com.

Site performance tools are still showing cookies for the images. Any suggestions?

Answer 1

Not that I'm an expert, but what I've implemented in the past has been in .htaccess, not defining privacy settings in EE, until now I've not given it much thought... This answer gives some light - what you've done is set it so cookies aren't sent back from that domain for the content generated by EE, but they will still be sent in the request, therefore failing the performance tests. Also remember that EE doesn't have any involvement in the static content - that's the server - the admin settings are only for content generated by EE - so if you had your CSS and JS files as templates, then this would be served by EE, otherwise if they're external files they're delivered directly from the server, not EE.

You don't have to have a separate domain to be able to deliver cookie-less content, the subdomain just assists in multiple domain calls (so multi-threaded requests). I read elsewhere that Google advises that it's only worth doing if you have more that 5 items - assuming images are delivered via the static, then it'll be worth it. As an example, if all your CSS is in one minified file and all your JS is in another, and the images were via a CDN, then there would be little point.

Opening http connections costs time, and it is not always the case that opening more connections is efficient. Reducing the number of resources is much more effective than just piling up lots of open HTTP connections.

This article gives a good description of specifying the .htaccess to remove cookie from the relevant file requests - note this is irrelevant of domain and is fairly self explanatory:

<FilesMatch "\.(js|css|jpg|png|jpeg|gif|xml|json|txt|pdf|mov|avi|otf|woff|ico|swf)$">
    RequestHeader unset Cookie
    Header unset Cookie
    Header unset Set-Cookie
</FilesMatch>

The second code from that article refers to unset eTag:

Entity tags (ETags) are a mechanism to check for a newer version of a cached file.

Ref.

unset pragma - I can't find a numpty guide by Googling, but all references go hand in hand with reducing the header and caching information, although I have read that this line doesn't explicitly state "don't cache the content", and elsewhere I've read some browsers may still assume. So might need Header set Pragma "no-cache" instead of their suggested Header unset Pragma.

This chunk I add to my .htaccess to set the browser caching time of certain files:

<IfModule mod_expires.c>
 ExpiresActive On
 <FilesMatch "\.(ico|jpg|jpeg|png|gif)$">
  ExpiresDefault "access plus 2 weeks"
 </FilesMatch>
 <FilesMatch "\.(js|css|swf)$">
  ExpiresDefault "access plus 2 days"
 </FilesMatch>
</IfModule>

And if you want to compress certain files sent from the server (still in the .htaccess file):

<IfModule mod_deflate.c>
# Insert filter
  SetOutputFilter DEFLATE
# Netscape 4.x has some problems...
  BrowserMatch ^Mozilla/4 gzip-only-text/html

# Netscape 4.06-4.08 have some more problems
  BrowserMatch ^Mozilla/4\.0[678] no-gzip

# MSIE masquerades as Netscape, but it is fine
# BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

# NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
# the above regex won't work. You can use the following
# workaround to get the desired effect:
  BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html

# Don't compress images
  SetEnvIfNoCase Request_URI \\.(?:gif|jpe?g|png)$ no-gzip dont-vary

# Make sure proxies don't deliver the wrong content
  Header append Vary User-Agent env=!dont-vary
</IfModule>

Note that the compression settings in EE are only relevant to the pages served by EE - templates. Not the external static/resource files.