5

Cookieless subdomains are considered beneficial for a number of purposes:

  • They save some network overhead [1], and
  • they are required for certain types of caching [7] (e.g. reverse proxy like Varnish).

The most straight-forward way to implement is to create a sub domain of the main domain (A or CNAME host record in DNS), then set up a virtual host on the webserver and lastly configure a CDN with shared sub domains. [2] suggests to configure the cookieless Vhosts in Apache like this:

<VirtualHost *:8081>
  ServerName cdn.example.com
  <Directory /var/www/example >
    RequestHeader unset Cookie
    Header unset Set-Cookie
    […]
  </Directory>
</VirtualHost>

In Drupal, a CDN with shared sub domains can be implemented with the 'CDN' module and a CDN mapping like suggested in [3]:

http://css.example.com|.css
http://js.example.com|.js
http://img.example.com|.jpg .jpeg .gif .png .ico

At this point, CSS, JS, and images are delivered through the respective subdomains; however, according to firebug, these objects still have cookies attached to them, so Varnish can't cache them efficiently (or not at all).

These are some sample cookies I'm getting attached to an image that is delivered through the CDN sub domain img.example.com:

__utma=192369400.1671803289.1403302173.1403302173.1403302173.1;
__utmz=192369400.1403302173.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
__utmv=192369400.|1=User%20roles=anonymous%20user=1;
__utma=164879789.945246956.1281184906.1403129675.1405102008.2582;
__utmc=164879789; __utmz=164879789.1396142298.2568.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
__utmv=164879789.authenticated%20user%2CSysop|1=User%20roles=anonymous%20user=1

All these cookies are set from/belong to the main domain www.example.com; I don't know what application/module sets the other cookies, but those including an Drupal user role are clearly set by Drupal. How do I get rid of them on images and what am I doing wrong here?

Some of the other cookies are probably set by the 'Google Analytics' module which are "usually set on a domain-wide basis to cover all subdomains" [6]. However, this module allows to configure ./admin/settings/googleanalytics, if GA is supposed to track one domain, or multiple sub domains (of course I chose "single domain").

Is an additional functionality required to allow Drupal (in my case Pressflow) to actually allow cookieless subdomains? For example, there is an 'Cookieless Subdomain' module at drupal.org [4] (undocumented; dev release; very few users). Do I need this, or is there another way outside of Drupal, e.g. in the Apache or Varnish configuration ([5] suggests that "varnish really isn't made to do redirects")?

[1] developer.yahoo.com/performance/rules.html#cookie_free
[2] webmasters.stackexchange.com/questions/1772/how-do-i-set-up-a-cookie-less-domain
[3] www.drupal.org/project/parallel
[4] www.drupal.org/project/cookieless_subdomain
[5] serverfault.com/questions/275728/varnish-serving-static-files-from-subdomains-for-better-page-load-speed
[6] serverdown.ttwait.com/que/275728
[7] www.ravelrumba.com/blog/static-cookieless-domain/ (Wordpress)

2

All these cookies are set from/belong to the main domain www.example.com;

Check your $cookie_domain value in settings.php

/**
 * Drupal automatically generates a unique session cookie name for each site
 * based on its full domain name. If you have multiple domains pointing at the
 * same Drupal site, you can either redirect them all to a single domain (see
 * comment in .htaccess), or uncomment the line below and specify their shared
 * base domain. Doing so assures that users remain logged in as they cross
 * between your various domains. Make sure to always start the $cookie_domain
 * with a leading dot, as per RFC 2109.
 */
# $cookie_domain = '.example.com';

the leading '.' means the cookies also apply to subdomains.

You could try something more specific, to restrict the drupal cookie domain, like:

$cookie_domain = '.www.example.com';
  • "Make sure to always start the $cookie_domain * with a leading dot, as per RFC 2109." - ?! – user153878 Jul 29 '14 at 13:04
  • Thanks for the pointer. I tried this with '.example.com' and '.www.example.com', and in both cases, the sessions for logged in users are lost immediately after logging in. When disabling the $cookie_domain setting, at least users can log into the site. I simply fail to understand how the Apache configuration, the Varnish configuration, and the Drupal configuration can be made to play together nicely. – user153878 Sep 7 '14 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.