title: spring security cookie path
body: <p>I need help regarding spring security cookie path.</p>
  
  <p>We have 2 web applications running in tomcat, app1 and app2. Both using the same domain, like www.company.com/app1 and www.company.com/app2 . Everything working fine and perfectly in tomcat.</p>
  
  <p>But when we migrate to WebSphere, it started give issue. The issue is when a user login to app1, app2 cookie got overwritten because WebSphere storing the cookie in root path / and both applications using the same domain will overwrite another application cookie. In tomcat it storing in application path like /app1 and /app2 so no problem.</p>
  
  <p>I am able to configure the WebSphere to make it work by configuring the application cookie path. Please see <a href="https://serverfault.com/questions/461518/websphere-jsessionid-cookie-overwrite-between-two-apps-on-the-same-domain-diffe">https://serverfault.com/questions/461518/websphere-jsessionid-cookie-overwrite-between-two-apps-on-the-same-domain-diffe</a> for how to configure in WebSphere.</p>
  
  <p>Now my question is, I don’t want to configure this in WebSphere. How can I do this in application level like configure the Spring Security xml or any other place. We want to make this in application level is because it will more portable and behave same in all containers. </p>
  
  <p>I have try to configure the web.xml by adding the following but it not working.</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;720&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;name&gt;JSESSIONID&lt;/name&gt;
          &lt;path&gt;/app1&lt;/path&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;secure&gt;true&lt;/secure&gt;
      &lt;/cookie-config&gt;
  &lt;/session-config&gt;
  </code></pre>