I have two web app running on same host on same path but on different port
and
now when I visit first app it serves the cookie say with name abc
, and now my browser has this abc
, now if I open another tab and goto app2 (https one), browser sends the cookie abc
in request (because of same domain, same path) and this app sets the secure flag true because its running on https
,
so now in my browser abc
is overriden by secureflag
= true
, so if I make request to app1 (which is running on http
), it doesn't send abc
because of secure flag and it makes me logout because abc
is session cookie
what is the secure way to overcome this,
both of the apps are mine so cookie hijacking from another app is not the case
I tried setting app2 at some other path /foo
so now its
and
if my browser has the cookie from foo first then everything goes ok, but if I hit app1 first then it still sends the cookie to /foo