Ok, I've got my primary site running EE1 at www.example.com. I've set up a subdomain of static.example.com, from which I want to serve static assets; specifically, files that don't need cookies being attached to the requests.
My EE -> Admin -> SysPrefs -> Cookie Settings are:
Cookie Domain: .www.example.com
Cookie Path: (ie. blank)
Cookie Prefix: (also blank)
Once those settings are verified, I logout of the backend and use Firebug + FireCookie to remove all cookies for the current domain. Loading up, say, static.example.com/css/main.css
shows that indeed, there are no cookies being transmitted with the static file request.
However, if I then load up the frontend of the EE site at www.example.com
, I see a number of cookies being stored: a JW Player cookie and a few Facebook and Google Analytics cookies - all of which are expected, along with 3 EE cookies: exp_tracker
, exp_last_visit
, and exp_last_activity
. All of those EE cookies have domains of .www.example.com
- but somehow ALL of them are also being transmitted when I request the aforementioned static.example.com/css/main.css
file.
I'm no cookie expert, but I would have expected that by specifying the .www
subdomain for the cookies in EE, they would have been restricted to requests that include that subdomain.
What am I doing wrong?