Care to be taken when serving static content (JS, CSS, Media) from different domain?

Question

Let me try to explain by example. Say website is hosted at example.com (NOT www.example.com). In order to serve static content cookie-free, I've chosen to use a different domain example-static.com.

Now, lets consider that my static content is currently served like this:

http://example.com/js/script.js
http://example.com/css/style.css
http://example.com/media/image.jpg

** Now I create a CNAME record aliasing example-static.com to my main domain i.e. example.com so that the static content is served as such:

http://example-static.com/js/script.js
http://example-static.com/css/style.css
http://example-static.com/media/image.jpg

** Is that all I have to do? Will all browsers execute JavaScript files and load web fonts without any security concerns? OR should I be using some .htaccess rules to modify header information and the like?

PS: It would be great if you can provide what rules should be added, if need be.

EDIT: The reason why I added a bounty to this question is that people I know have advised me against serving JS from a different domain. They aren't able to give me a clear explanation either.

Answer 1

It will work without extra config. However: does it worth the pain? If you use some real content delivery network that's fine, but simply faking one, to be cookie-free? A much better approach would be to minimize cookie size IMHO.

Answer 2

Gergely's answer answers my question. And I've also found an alternative. Since my website is served from example.com, instead of serving static content from a different domain, I am planning to serve the cookies themselves from a different sub-domain www.example.com.

Simple, and should do the job.