Contents
- 1 How do you set a cookie-free domain?
- 2 Can you set a cookie for a different subdomain?
- 3 How is cookie domain set?
- 4 Can you read cookies from other domains?
- 5 What is the difference between set cookie and cookie header?
- 6 What does it mean to set up a cookie less domain?
- 7 How are cookies set in an ASP.NET server?
- 8 How do I add cookies to my IIS server?
How to use cookie-free domains in WordPress
- Create a subdomain, such as static.yourwebsite.com , which is where you will deliver all your static files from.
- Point your new subdomain to the /wp-content directory of your WordPress installation.
8 Answers. Two different domains (e.g. mydomain.com and subdomain.mydomain.com , or sub1.mydomain.com and sub2.mydomain.com ) can only share cookies if the domain is explicitly named in the Set-Cookie header.
Should you set cookie domain?
To summarize, rules to follow regarding cookie domain: The origin domain of a cookie is the domain of the originating request. If the origin domain is an IP, the cookie’s domain attribute must not be set. If a cookie’s domain attribute is not set, the cookie is only applicable to its origin domain.
They are a part of the HTTP protocol, defined by the RFC 6265 specification. Cookies are usually set by a web-server using the response Set-Cookie HTTP-header. Then, the browser automatically adds them to (almost) every request to the same domain using the Cookie HTTP-header.
You cannot share cookies across domains. You can however allow all subdomains to have access. To allow all subdomains of example.com to have access, set the domain to .
Can cookies belong to multiple domains?
1 Answer. A cookie can only have 1 domain value. So you can either set it to a specific domain or the top domain wich includes all the subdomains.
The Set-Cookie header is sent by the server in response to an HTTP request, which is used to create a cookie on the user’s system. The Cookie header is included by the client application with an HTTP request sent to a server, if there is a cookie that has a matching domain and path.
When things like YSlow and Page Speed tell you to set up cookie-less domains, what they actually mean is serve media from a domain where you won’t be setting any, or have not set any (globally) in the past.
How to set up a cookieless web site?
To have a cookieless domain you have to make sure your application running on that domain doesn’t set any cookies. This usually means not having logins, not having google analytics, not having sessions – i.e just serving media and nothing else. Obviously this depends on your setup.
Cookies are set in two ways – by session cookies (e.g. by ASP or ASP.NET requests) or explicitly by your application. These will be posted back TO the server on each subsequent request for the domain that set the cookie (regardless of whether the request is for static or dynamic content) thus increasing the request payload.
In IIS it’s your application, ISAPI Filter or ISAPI extension that will add a cookie. If your IIS server is not intercepting requests for static content (because this is usually handled by the kernel mode http.sys driver) then no cookies will be added to the response. It’s only further up the request pipeline that cookies come into play.