Reverse proxy isolation from insecure blog, are sessions vulnerable?

Question

Hi I have a WebApp where security is important. E.g.

www.somewebapp.com

The app has a wordpress blog (hence not secure since wordpress). e.g.

www.somewebapp.com/blog

To protect the webapp from the insecure blog, the blog is hosted on a separate server.

We use nginx reverse proxy to redirect all /blog queries to the blog server.

My question does this mean the webapp is fully protected from the insecure blog?

My concern is especially re: Sessions. Since the domain for blog and webapp is the same they would share the same sessions?

If blog server is compromised would an attacker be able to obtain the session data that is valid for the webapp? Could he do something malicious with that?

For additional info, I use the below config nginx for redirecting blog queries.

location /blog {
        proxy_pass https://blog_ip:port;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Answer 1

Yes, your concern is justifiable.

From the Set-Cookie documentation at Mozilla:

Path=<path-value> Optional
    Indicates a URL path that must exist in the requested resource before sending
    the Cookie header. The %x2F ("/") character is interpreted as a directory 
    separator and sub directories will be matched as well (e.g. path=/docs, 
    "/docs", "/docs/Web/", or "/docs/Web/HTTP" will all be matched).

That means that all cookies you set for your main app with Path=/ will be sent with requests to /blog, too.