How do I make my asp.net website "more cookie free"?

Question

I ran my website through Yahoo's YSlow on my asp.net (vb) website that has 47 pages. There were a few problems, but one of them said I get a "Grade F on Use cookie-free domains".

Specifically, it says:

When the browser requests a static image and sends cookies with the request, the server ignores the cookies. These cookies are unnecessary network traffic. To workaround this problem, make sure that static components are requested with cookie-free requests by creating a subdomain and hosting them there.

I really don't know what they're trying to tell me. They say 43 components on my homepage aren't cookie-free, including: site.css, print.css, homeslider.js, and then 38 or 39 .jpg or .png images aren't cookie-free.

Does anybody know how I can improve this and improve my site's performance? Thank you for any suggestions you can offer!

Maganmagana

Answer 1

When a "static" file like an image or css is requested from your site, the browser sends cookies along with the request. These cookies are useless as the images/css don't change depending on the cookie contents.

To make your static content requests cookie free, serve them from a different domain. For example:

• Main website: www.mysite.com;
• Images, CSS, JS, etc.: www.mysitecontent.com

Alternatively, you could use subdomains eg static.mysite.com assuming you specifically tie cookies to the subdomain (eg set cookies for www.mysite.com not just mysite.com). If you're not sure, it's usually easier to use a different domain name

As an example, use firebug or a similar extension to look at this page. You'll note that "static" content comes from sstatic.com not stackoverflow.com

For large sites, it's not uncommon to use a CDN for your static files. For small sites, it's one webserver and multiple virtual hosts is the norm.

Reef

Thank you very much for the information, Basic. I think I'm getting the idea of static content, http requests, etc. ... I have HTTP Response Headers set up to expire every 30 minutes. I'll have to recode my images and .css, .js, etc., to come from another domain. Thank you for taking the time to share some knowledge! – Maganmagana

Answer 2

Make sure your website is only loaded from www.domain.com and not domain.com.

Make sure all static images are loaded from static.domain.com.

Here is a blog post that explains more: http://www.ravelrumba.com/blog/static-cookieless-domain/

Frieder

Thank you, @Brandon, for taking the time to respond. I read through the blog you linked me to, and that had some useful information in it -- including an alternative website that lets you create a cookie-free domain without having to register a second domain. I appreciate your help! – Maganmagana