Ok, I've got my primary site running EE1 at www.example.com. I've set up a subdomain of static.example.com, from which I want to serve static assets; specifically, files that don't need cookies being attached to the requests.
My EE -> Admin -> SysPrefs -> Cookie Settings are:
Cookie Domain: .www.example.com Cookie Path: (ie. blank) Cookie Prefix: (also blank)
Once those settings are verified, I logout of the backend and use Firebug + FireCookie to remove all cookies for the current domain. Loading up, say,
static.example.com/css/main.css shows that indeed, there are no cookies being transmitted with the static file request.
However, if I then load up the frontend of the EE site at
www.example.com, I see a number of cookies being stored: a JW Player cookie and a few Facebook and Google Analytics cookies - all of which are expected, along with 3 EE cookies:
exp_last_activity. All of those EE cookies have domains of
.www.example.com - but somehow ALL of them are also being transmitted when I request the aforementioned
I'm no cookie expert, but I would have expected that by specifying the
.www subdomain for the cookies in EE, they would have been restricted to requests that include that subdomain.
What am I doing wrong?