3 ms·

Would this really work? Won't they be sharing cookies unless the static files are on a different domain?

• agwa 13y ago
  Doesn't matter if they share cookies. Static files reflect neither user-supplied data nor secrets in their contents, so they can't be used in a BREACH attack.
  • andrewingram 13y ago
    Additionally, you should be serving static files from a different domain anyway so that you can get the performance gains from cookie-less requests.
    • bobwaycott 13y ago
      Can you point out some more info/sources on these performance gains?
      • andrewingram 13y ago
        https://developers.google.com/speed/docs/best-practices/request#ServeFromCookielessDomain https://developers.google.com/speed/docs/best-practices/requ...