Every request carries four kilobytes
A team added a few cookies scoped to Domain=example.com — a feature-flag payload, a locale, an experiment assignment. Small things.
Now every request to assets.example.com carries them too, because Domain scope is a subtree and not a hostname. There is no attribute that excludes one host from it. The edge in front of the assets keys on Cookie, so its hit rate collapsed, and every image request drags a few kilobytes uphill on a link that is slow in exactly that direction.
Boundaries, outermost first: *.example.com: The app (app.example.com), The asset host (assets.example.com; FAILED: gets them too) Outside every boundary: Browser (holds the jar), Three cookies (Domain=example.com), an empty slot for the where the assets should live Connections: Browser calls Three cookies — on every request (step 1) Three cookies calls The app — in scope (step 2) Three cookies calls The asset host — also in scope (step 3) where the assets should live controls The asset host (step 4)