Pros and Cons of a separate image server (e.g. images.mydomain.com)?

Question

We have several images and PDF documents that are available via our website. These images and documents are stored in source control and are copied content on deployment. We are considering creating a separate image server to put our stock images and PDF docs on - thus significantly decreasing the bulk of our deployment package.

Does anyone have experience with this approach?

I am wondering about any "gotchas" - like XSS issues and/or browser issues delivering content from the alternate sub-domain?

Answer 1

Pro:

Many browsers will only allocate two sockets to downloading assets from a single host. So if index.html is downloaded from www.domain.com and it references 6 image files, 3 javascript files, and 3 CSS files (all on www.domain.com), the browser will download them 2 at a time, with the other blocking until a socket is free.

If you pull the 6 image files off onto a separate host, say images.domain.com, you get an extra two sockets dedicated to download your images. This parallelizes the asset download process so, in theory, your page could render twice as fast.

Con:

If you're using SSL, you would need to either get an additional single-host SSL certificate for images.domain.com or a wildcard SSL certificate for *.domain.com (matches any subdomain). Failure to do so will generate a warning in the browser saying the page contains mixed secure and insecure content.

Answer 2

You will also, with a different domain, not send the cookies data with every request. This can increase performance.

Answer 3

Another thing not yet mentioned is that you can use different web servers to serve different sorts of content. For example, your static content could be served via lighttpd or nginx while still serving your dynamic content off Apache.

Answer 4

Pros:

-load balancing

-isolating a different functionality

Cons:

-more work (when you create a page on the main site you would have to maintain the resources on the separate server)

Things like XSS is a problem of code not sanitizing input (or output for that matter). The only issue that could arise is if you have sub-domain specific cookies that are used for authentication.. but that's really a trivial fix.

Answer 5

If you're serving HTTPS and you serve an image from an HTTP domain then you'll get browser security alert warnings pop up when you use it.

So if you do HTTPS, you'll need to buy HTTPS for your image domain awell if you don't want to annoy the hell out of your users :)

There are other ways around this, but it's not particularly in the scope of this answer - it was just a warning!