Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up a specific subdomain on my server for static content --

I'd like to configure Apache to never let cookies be set on that domain. But I'm not sure where/how to do that. Please advise :-)


share|improve this question
If it is a static content, then how would it get the cookies? Cookies are usually added by dynamic content providers, like a PHP script. Some Apache modules can also emit their cookies, I guess, but that would be also kind of dynamic content. If you are bothered by a specific cookie added by some Apache module, then show it, so we can say what the module might have generated that. – Jacek Konieczny Mar 2 '10 at 19:36
Hey -- thanks for the note. Maybe I'm getting invalid data here. The Firebug "page speed" plugin is suggesting I serve static content from a domain that doesn't set cookies, and specifically mentions this file: But it doesn't appear to actually be sending a cookie back with the style sheet. Do you see what I mean? – Eric Mar 2 '10 at 20:33
p.s. here's a screen shot of what the tool is showing me; it seems to think that cookies are coming along with my style sheets and images as well. – Eric Mar 2 '10 at 20:35

Using mod_headers ( you can manipulate all headers that Apache sends to the client. Something like

RequestHeader unset Set-Cookie

Inside the VirtualHost of your subdomain should do the trick.

share|improve this answer

I don't think apache can be the enforcer here. Even the RequestHeader unset option above will only happen after the client has sent the request with the cookie.

The key thing here the google page speed tool is noticing is that the client sends the cookie on the request. That means somewhere in your application you have set a cookie (so in effect, * You need to carefully only ever set (or whatever subdomain you're using) in your cookies code. Truthfully, most professional websites wind up with so many third party widgets and javascripts and browser calls that its easier to just abandon your "main" domain for this and setup a full second domain that will never ever have a cookie set on it. You can see facebook does this with does this with

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.