cookie issue with same domain same path but different port

Question

I have two web app running on same host on same path but on different port

http://somedomain.com/

and

https://somedomain.com/

now when I visit first app it serves the cookie say with name abc, and now my browser has this abc, now if I open another tab and goto app2 (https one), browser sends the cookie abc in request (because of same domain, same path) and this app sets the secure flag true because its running on https,

so now in my browser abc is overriden by secureflag = true, so if I make request to app1 (which is running on http), it doesn't send abc because of secure flag and it makes me logout because abc is session cookie

what is the secure way to overcome this,

both of the apps are mine so cookie hijacking from another app is not the case

I tried setting app2 at some other path /foo

so now its

http://somedomain.com

and

https://somedomain.com/foo

if my browser has the cookie from foo first then everything goes ok, but if I hit app1 first then it still sends the cookie to /foo

Answer 1

The easiest and clearest solution is simply using differently named cookies (in addition to setting secureflag=true on the secure site cookie), eg. abc and abc_secure. This also makes development and debugging much much easier.