example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths -
example.com/secure_zone is accessible only via HTTPS and contains information that shouldn't be accessed by attacker.
example.com/secure_zone has its cookie with path set to
Are there any security issues here? Is there a difference if cookie doesn't have httponly attribute?