Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have two web app running on same host on same path but on different port

http://somedomain.com/

and

https://somedomain.com/

now when I visit first app it serves the cookie say with name abc, and now my browser has this abc, now if I open another tab and goto app2 (https one), browser sends the cookie abc in request (because of same domain, same path) and this app sets the secure flag true because its running on https,

so now in my browser abc is overriden by secureflag = true, so if I make request to app1 (which is running on http), it doesn't send abc because of secure flag and it makes me logout because abc is session cookie

what is the secure way to overcome this,

both of the apps are mine so cookie hijacking from another app is not the case

I tried setting app2 at some other path /foo

so now its

http://somedomain.com

and

https://somedomain.com/foo

if my browser has the cookie from foo first then everything goes ok, but if I hit app1 first then it still sends the cookie to /foo

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

The easiest and clearest solution is simply using differently named cookies (in addition to setting secureflag=true on the secure site cookie), eg. abc and abc_secure. This also makes development and debugging much much easier.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.