Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications
http://www.example.com/app1/
and http://www.example.com/app2/
.
I don't want those applications to be able to get access to each other cookies, especially because I want to contain a potential XSS vulnerability to one application only. Is it sufficient to set the path of the cookies accordingly? The http-only flag is not set in this scenario.
If setting the cookie path is not enough, I would be interested which additional steps should be taken.