Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two web app running on same host on same path but on different port


now when I visit first app it serves the cookie say with name abc, and now my browser has this abc, now if I open another tab and goto app2 (https one), browser sends the cookie abc in request (because of same domain, same path) and this app sets the secure flag true because its running on https,

so now in my browser abc is overriden by secureflag = true, so if I make request to app1 (which is running on http), it doesn't send abc because of secure flag and it makes me logout because abc is session cookie

what is the secure way to overcome this,

both of the apps are mine so cookie hijacking from another app is not the case

I tried setting app2 at some other path /foo

so now its


if my browser has the cookie from foo first then everything goes ok, but if I hit app1 first then it still sends the cookie to /foo

share|improve this question
up vote 5 down vote accepted

The easiest and clearest solution is simply using differently named cookies (in addition to setting secureflag=true on the secure site cookie), eg. abc and abc_secure. This also makes development and debugging much much easier.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.