Question

Let me try to explain by example. Say website is hosted at example.com (NOT www.example.com). In order to serve static content cookie-free, I’ve chosen to use a different domain example-static.com.

Now, lets consider that my static content is currently served like this:

http://example.com/js/script.js
http://example.com/css/style.css
http://example.com/media/image.jpg

** Now I create a CNAME record aliasing example-static.com to my main domain i.e. example.com so that the static content is served as such:

http://example-static.com/js/script.js
http://example-static.com/css/style.css
http://example-static.com/media/image.jpg

** Is that all I have to do? Will all browsers execute JavaScript files and load web fonts without any security concerns? OR should I be using some .htaccess rules to modify header information and the like?

PS: It would be great if you can provide what rules should be added, if need be.

EDIT: The reason why I added a bounty to this question is that people I know have advised me against serving JS from a different domain. They aren’t able to give me a clear explanation either.

Answer 1

It will work without extra config. However: does it worth the pain? If you use some real content delivery network that’s fine, but simply faking one, to be cookie-free? A much better approach would be to minimize cookie size IMHO.