Static Cookieless Domain

Can someone explain to me how to set up cookieless domain? There are many posts regarding this matter, but I'm still confused.

I understand that transmitting session information for static resources is dead weight, and want to eliminate this overhead. My confusion probably lies in whether implementing this scenario, is a configuration of the

• client
• the server
• or both.

Suppose the user logs into a site (and the login details are stored in a cookie):

• In the HTTP packet, the cookie is set along with the page to render
• When the browser interprets the page, and encounters references to static resources in the header,
  • the browser generates new HTTP requests to fetch those resources
  • and by default sends the cookie along with those requests
  • how could I instruct the browser not to do so for these resources?
  开发者_StackOverflow社区

The defacto method of implementing this scenario is to set up a 'static domain'.

• Which is simply another domain or a sub-domain:
  • which could reference the resources in the original domain, or keep a duplicate
  • and would be void of any scripts, like an index.php
  • and would have an .htaccess to prevent directory browsing
• Is there crucial property of this 'static' subdomain that I'm missing?
  • What's up with the CNAME record?
  • Is there a way of configuring a domain to not accept cookies?
  • Even if there is, how would the browser know which domains to send cookies to, and which ones not to?

Lots of questions. I'm missing something crucial here. Hope someone can help.

I'm developing a site with codeigniter, if it makes a difference. And the webserver I'm using is a cPanel driven Apache server.

---

A cookie-less domain is basically a domain that a specific cookie is not valid for. As HTTP cookies can be limited to a specific domain (or super-domain and its sub-domains), you should choose that domain so that it doesn’t match the cookie-less domain.

To do that you need to know how the Domain attribute value is interpreted:

• If the Domain attribute is missing, a cookie is only valid for the domain it was specified in.
• If the Domain attribute is present, its value must begin with a . and its effective domain value is the Domain attribute value without the leading . and all its sub-domains.

---

Cookies have an associated domain. You should ensure that the cookies you set have a domain that will not match the domain of your static domain.

http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path