One issue is that you should not use any compression (http or tls) on a request/response with any sensitive info, such as session ids or csrf tokens (see beast, crime attacks).
It's easy to turn off compression on your www domain and turn it on on your cdn domain.
So now you're not compressing your css, which would slow the response time, but by how much I can't say. You could still use css minification.
What I was trying to say is that, if you're security conscious, and running a CDN anyway, it might not be worth the risk to allow (selective) HTTP compression on your main web domain. It would be safer to disable it completely.
Comments
One issue is that you should not use any compression (http or tls) on a request/response with any sensitive info, such as session ids or csrf tokens (see beast, crime attacks).
It's easy to turn off compression on your www domain and turn it on on your cdn domain.
So now you're not compressing your css, which would slow the response time, but by how much I can't say. You could still use css minification.
you're confusing content compression with header compression. it's fine to pre-gzip your css before serving it over http or tls.
HTTP compression is simply not safe on your main web domain: http://security.stackexchange.com/questions/20406/is-http-co...
What I was trying to say is that, if you're security conscious, and running a CDN anyway, it might not be worth the risk to allow (selective) HTTP compression on your main web domain. It would be safer to disable it completely.