3 ms·
> what's "third-party" That's already defined by the same-origin policy. > a common optimization technique Optimization should never happen at the expense of
by pdkl95 11y ago
> what's "third-party"
That's already defined by the same-origin policy.
> a common optimization technique
Optimization should never happen at the expense of security. (and yes, 3rd party scripts are a security risk)
> increase the number of parallel connections.
I believe that trick is to save bandwidth by not sending the (large) cookies that would normally be sent to the normal domain.
- richardwhiuk 11y ago>> increase the number of parallel connections. > I believe that trick is to save bandwidth by not sending the (large) cookies that would normally be sent to the normal domain. No, Internet Explorer (and other browsers) used to only allow a small number of connections per domain. Long running COMET requests ate up these connections, so if you wanted to simultaneously download multiple resources from a single domain, and reduce time to page ready, then you had to use multiple domains.
- extra88 11y agoThe limit is per host, not per domain. Before using CDNs became commonplace, it was not unusual for a site to use multiple hostnames of their own to spread out their content and have more parallel connections for a single page load; example.com img1.example.com, img2.example.com, etc.
- richardwhiuk 11y agoIt's per FQDN, not per host. Host refers to either an individual machine, or an IP address, and the restriction is to neither of these.
- extra88 11y agoBy "host," I meant FQDN. I think my examples made it clear that I didn't mean per ip or machine.
- extra88 11y agoWorking around browsers' maximum concurrent connections settings is a major reason to use multiple hosts. This table of browser [0] is somewhat dated but these limitations have been have always been present since the first browsers, I doubt they've radically changed in the last few years. [0] http://sgdev-blog.blogspot.com/2014/01/maximum-concurrent-connection-to-same.html http://sgdev-blog.blogspot.com/2014/01/maximum-concurrent-co...
- pdkl95 11y agoI could have outdated information; in either case speed isn't as important as security. Why haven't servers started advertising how many connections they are willing to accept? The need for other domains could be easily removed with something like an HTTP response header: 200 Ok ... X-Max-Parallel-Connection: 10 ... This type of header could even be used to give per-page values: X-Max-Parallel-Connection: 20, scope=local-page-only (there's probably a better way to phrase these, but that works as an example) Yes, I know these are not supported by browsers yet, but sensibility is one of the best features of HTTP.
- icebraining 11y agoThat's been kinda pre-empted by HTTP2, with its TCP multiplexing and server pushing.