They are under the same domain but in different ports.
server api ---- www.example.com:9000/api/endpoints
web app ---- www.example.com:9001
Now, we save two types of cookies.
user-session-cookie # authenticate the user. secure = True, http = True
csrftoken # secure = True
I wonder in general, is this implementation secure? In what circumstance the site is not secure?