How do I implement cookieless subdomain?

Question

Cookieless subdomains are considered beneficial for a number of purposes:

• They save some network overhead [1], and
• they are required for certain types of caching [7] (e.g. reverse proxy like Varnish).

The most straight-forward way to implement is to create a sub domain of the main domain (A or CNAME host record in DNS), then set up a virtual host on the webserver and lastly configure a CDN with shared sub domains. [2] suggests to configure the cookieless Vhosts in Apache like this:

<VirtualHost *:8081>
  ServerName cdn.example.com
  <Directory /var/www/example >
    RequestHeader unset Cookie
    Header unset Set-Cookie
    […]
  </Directory>
</VirtualHost>

In Drupal, a CDN with shared sub domains can be implemented with the 'CDN' module and a CDN mapping like suggested in [3]:

http://css.example.com|.css
http://js.example.com|.js
http://img.example.com|.jpg .jpeg .gif .png .ico

At this point, CSS, JS, and images are delivered through the respective subdomains; however, according to firebug, these objects still have cookies attached to them, so Varnish can't cache them efficiently (or not at all).

These are some sample cookies I'm getting attached to an image that is delivered through the CDN sub domain img.example.com:

__utma=192369400.1671803289.1403302173.1403302173.1403302173.1;
__utmz=192369400.1403302173.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
__utmv=192369400.|1=User%20roles=anonymous%20user=1;
__utma=164879789.945246956.1281184906.1403129675.1405102008.2582;
__utmc=164879789; __utmz=164879789.1396142298.2568.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
__utmv=164879789.authenticated%20user%2CSysop|1=User%20roles=anonymous%20user=1

All these cookies are set from/belong to the main domain www.example.com; I don't know what application/module sets the other cookies, but those including an Drupal user role are clearly set by Drupal. How do I get rid of them on images and what am I doing wrong here?

Some of the other cookies are probably set by the 'Google Analytics' module which are "usually set on a domain-wide basis to cover all subdomains" [6]. However, this module allows to configure ./admin/settings/googleanalytics, if GA is supposed to track one domain, or multiple sub domains (of course I chose "single domain").

Is an additional functionality required to allow Drupal (in my case Pressflow) to actually allow cookieless subdomains? For example, there is an 'Cookieless Subdomain' module at drupal.org [4] (undocumented; dev release; very few users). Do I need this, or is there another way outside of Drupal, e.g. in the Apache or Varnish configuration ([5] suggests that "varnish really isn't made to do redirects")?

[1] developer.yahoo.com/performance/rules.html#cookie_free
[2] webmasters.stackexchange.com/questions/1772/how-do-i-set-up-a-cookie-less-domain
[3] www.drupal.org/project/parallel
[4] www.drupal.org/project/cookieless_subdomain
[5] serverfault.com/questions/275728/varnish-serving-static-files-from-subdomains-for-better-page-load-speed
[6] serverdown.ttwait.com/que/275728
[7] www.ravelrumba.com/blog/static-cookieless-domain/ (Wordpress)

Answer 1

All these cookies are set from/belong to the main domain www.example.com;

Check your $cookie_domain value in settings.php

/**
 * Drupal automatically generates a unique session cookie name for each site
 * based on its full domain name. If you have multiple domains pointing at the
 * same Drupal site, you can either redirect them all to a single domain (see
 * comment in .htaccess), or uncomment the line below and specify their shared
 * base domain. Doing so assures that users remain logged in as they cross
 * between your various domains. Make sure to always start the $cookie_domain
 * with a leading dot, as per RFC 2109.
 */
# $cookie_domain = '.example.com';

the leading '.' means the cookies also apply to subdomains.

You could try something more specific, to restrict the drupal cookie domain, like:

$cookie_domain = '.www.example.com';