Comment on Revisiting the “Cookieless Domain” RecommendationparentComments−bluesmoon11yyou're confusing content compression with header compression. it's fine to pre-gzip your css before serving it over http or tls.−elchief11yHTTP compression is simply not safe on your main web domain: http://security.stackexchange.com/questions/20406/is-http-co...What I was trying to say is that, if you're security conscious, and running a CDN anyway, it might not be worth the risk to allow (selective) HTTP compression on your main web domain. It would be safer to disable it completely.
Comments
you're confusing content compression with header compression. it's fine to pre-gzip your css before serving it over http or tls.
HTTP compression is simply not safe on your main web domain: http://security.stackexchange.com/questions/20406/is-http-co...
What I was trying to say is that, if you're security conscious, and running a CDN anyway, it might not be worth the risk to allow (selective) HTTP compression on your main web domain. It would be safer to disable it completely.