posted 19 years ago
I have a secure and insecure web application. The secure one deals with payment/billing services for a user while the other deals with browsing catalogs etc. The user experience should be seamless as he browses non-secure and secure parts of the application. Both applications are served from the same domain and need to use cookies.
In order to ensure security the cookies (from each application) should not be scoped just at the domain level but rather scoped to an application level within a domain. How do I do this? Do I need to check with my container if it offers anything on this? Thoughts..?
How did others here deal when they had secure and insecure parts of application using cookies?
