Hacker News Reader

Is it better to use two different domains for API and static content then, in order for cookies to be only sent to the API domain/subdomain? That way, if there are requests to the static content that's served by a CDN (ie: Cloudflare), it won't contain sensitive cookie information?

View on HN

This is good practice anyway because it avoids the overhead of sending cookies for static content when they're not needed.

Cloudflare forces a cfduid cookie no matter what, even on pure-static-caching

This would still save you having to send all other cookies from your non-static domain.

In HTTP2 the opposite is true.

Single domain will help you with performance

Actually with http2 you can multiplex requests for multiple domains within a single connection. As long as the DNS for the domains is the same IP, and you have a single certificate covering both domains.

Reply on news.ycombinator.com