Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run over a hundred web applications (growing daily) on a LAMP stack using Apache2 on Ubuntu 10.04.

We've would like all requests to static content to be cookieless.

We host applications on many different domains, a majority of which as SaSS applications. Many of the domains host instances of the applications on sub domains, ie., etc..

At the moment all static content is server relative to the (sub)domain requesting it.

As far as I understand the process, I would need to setup a new domain, eg.

In this case is special configuration in the virtual host for this domain required to ensure no cookies are served?

Also, would it be possible to instead use

In this case what configurations would I need in my virtual host for this subdomain to ensure no cookies are served?

share|improve this question
What do you mean by "cookieless virtual host"? Cookies aren't generally generated for static content -- ever -- unless you've (a) done something wacky with your web server or (b) you're serving static content through your web application. Can you give us a more specific description of your problem? – larsks Feb 13 '11 at 4:56
I've updated the question to be more informative. – xzyfer Feb 13 '11 at 6:42
up vote 3 down vote accepted

When you setup a different domain (not subdomain) to serve static content it will be without cookies. The cookies are set by the application and not the webserver.

Example. yahoo uses to serve static content. When a page on refers to a object on the cookie of is not sent with the request sent to domain because cookies of one domain can't be accessible by another.

I would suggest that you use for serving static content instead of For this you wouldn't need to do anything special in the webserver for cookies. Configure the static-domain as you would a normal domain and start using it.

share|improve this answer

First, the easy part: DNS. All you need to do is create extra records that point to the server, whether you create them as CNAME records of an existing hostname, or A records pointing directly to the IP adrdress is up to you.

Second, the medium part: Apache. You don't explain what you're hosting or if you have virtual hosts already. The easiest solution is to turn virtual hosting off entirely (no VirtualHost or NameVirtualHost commands in your configuration at all, only a global-level DocumentRoot) which will make apache serve the exact same site no matter how the client connected. Otherwise, if you want to use different DocumentRoots for different hostnames, you'll need to set NameVirtualHost to something like *:80, then create <VirtualHost *:80> (must match NameVirtualHost's setting) records like

<VirtualHost *:80>
   DocumentRoot /var/www/
<VirtualHost *:80>
   DoumentRoot /var/www/static

Finally, the hard part: Making it "cookieless". Domain-level cookies are sent to every site in that domain, so you must either buy a completely separate domain (say, or else force everyone to use "" and issue cookies valid only on "" in your application. The forcing part can be done with

<VirtualHost *:80>
   RedirectPermanent /

Fixing the cookies in your application is up to you. For example, see the $domain field of PHP's setcookie() function.

If you go with the separate domain, then instead of the above redirect, you could add a ServerAlias line to the VirtualHost.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.