Prevent ASP.NET cookies from being sent on every css, js, image request

ASP.NET generates some large cookies if you are using ASP.NET membership provider. Especially if you are using the Anonymous provider, then a typical site will send the following cookies to every request when a user is logged in, whether the request is to a dynamic page or to any static resource:

.DBANON=w3kYczsH8Wvzs6MgryS4JYEF0N-8ZR6aLRSTU9KwVaGaydD6WwUHD7X9tN8vBgjgzKf3r3SJHusTYFjU85y
YfnunyCeuExcZs895JK9Fk1HS68ksGwm3QpxnRZvpDBAfJKEUKee2OTlND0gi43qwwtIPLeY1;
ASP.NET_SessionId=bmnbp155wilotk45gjhitoqg; DBAUTH12=2A848A8C200CB0E8E05C6EBA8059A0DBA228FC5F6EDD29401C249D2
37812344C15B3C5C57D6B776037FAA8F14017880E57BDC14A7963C58B0A0B30229
AF0123A6DF56601D814E75525E7DCA9AD4A0EF200832B39A1F35A5111092F0805B
0A8CD3D2FD5E3AB6176893D86AFBEB68F7EA42BE61E89537DEAA3279F3B576D0C
44BA00B9FA1D9DD3EE985F37B0A5A134ADC0EA9C548D

There are 517 bytes of worthless data being sent to every css, js and images from the browser to your webserver!

You might think 517 bytes is peanut. Do the math:

• Avg page has 40 requests to server. 40 x 517 bytes = 20 KB per page view.
• 1M page views = 20 GB
• That’s 20GB of data getting uploaded to your server for just 1M page views. It does not take millions of users to produce 1M page views. Around 100k+ users using your site every day can produce 1M page views every day.

Here’s how to prevent this:

• Setup a new website and map a different subdomain to it. If your main site is www.yoursite.com then map static.yoursite.com to it.
• Manually change all the <link>, <script>, <img> css url(…) and prefix each resource with http://static.yoursite.com
• If you don’t want to do it manually, use this solution I have done before.
• Add a Global.asax and in the EndRequest do this trick:

  HttpContext context = HttpContext.Current;
  if (context.Request.Url.ToString.StartsWith("http://static.yoursite.com")
  {
    List<string> cookiesToClear = new List<string>();
    foreach (string cookieName in context.Request.Cookies)
    {
      HttpCookie cookie = context.Request.Cookies[cookieName];
      cookiesToClear.Add(cookie.Name);
    }
  
    foreach (string name in cookiesToClear)
    {
      HttpCookie cookie = new HttpCookie(name, string.Empty);
      cookie.Expires = DateTime.Today.AddYears(-1);
  
      context.Response.Cookies.Set(cookie);
    }
  }

  This code reads all the cookies it receives from request and expires them so that browser does not send those cookies again. If by any chance ASP.NET cookies get injected into the static.yoursite.com domain, this code will take care of removing them.