Avoiding cookies while requesting static content

Question

I just did an audit of one of my web application page (built using ASP.Net and running on development server) using Google chrome's developer tool. One particular warning caught my eyes:

Serve static content from a cookieless domain (5)!

I would like to know is it possible to avoid cookies for these kind of requests. I see that there is no cookie requests for javascript files as well. I it possible to avoid cookies in the header for these files as well? and why didn't the browser attach cookies for javascript files and attach for CSS and image?

Could you fix the image, or remove the link? – Laurel Apr 22 '16 at 00:06 — Laurel, Apr 22 '16 at 00:06

score 2 · Accepted Answer · answered May 31 '10 at 12:30

2

Cookie are "attached" to a domain and a path. If you set cookies for a path above your files, they'll be sent with any request for those files.

The warning message itself tells you how to fix this - use another domain for your static content. Or a subdomain, as long as you make sure you keep your main domain cookieless in that case.

answered May 31 '10 at 12:30

Matti Virkkunen

63,558
9
127
159

yes, I understood that the solution is to move the files to a cookieless domain. What I need to know is why cookies did not get attached to javascript files during the request and only to css and image? – Abdel Raoof Olakara May 31 '10 at 12:37
@Abdel: Perhaps the tool missed those requests. Got a link to the page in question so I could see for myself? – Matti Virkkunen May 31 '10 at 12:38
unfortunately no.. let me check again if the tool missed them out – Abdel Raoof Olakara May 31 '10 at 13:12

score 0 · Answer 2 · answered Aug 05 '21 at 16:35

The easiest thing to do is to follow the exact suggestion in the warning message you pasted in (serve your static assets from a completely different hostname on which you don't set cookies). But in modern browsers you now also have the option of setting the crossorigin="anonymous" attribute on the relevant elements, which will prevent cookies from being sent for the matching requests. You will need to combine this with returning an access-control-allow-origin: YOUR-ORIGIN-HERE.com header in your static asset responses.

Avoiding cookies while requesting static content

2 Answers2

Linked