javascript - Are there any security implications of serving a page over HTTP on the same domain, but different port, as a service served over HTTPS? -

if have html page served on http @ http://example.com:123, , served on https @ https://example.com:456/some_app, there risk https app? note following mitigations assumed in place:

• the http page entirely unauthenticated , contains public information
• the cookies https page marked secure
• the https page uses standard anti-csrf patter such double submit

the main risk see attacker intercept http request , send page malicious javascript. while undesirable, can't see way attack escalate. despite the overly permissive access controls on cookies, attacker should not able steal https page's cookies, because marked secure. far cross origin requests go, requests made http page considered coming different origin, csrf protections work there.

are there attack venues i'm missing? or https app reasonably safe?

the "secure" attribute of cookies prevents cookies being sent http request sent https. there nothing prevent javascript on http page reading cookie if, example, has been tampered either in transit include javascript or vulnerable xss flaw.

this remediated setting httponly flag secure flag may not work double protection csrf implementation if javascript needed read cookie.

edit: comments below state chrome (at least) prevents when secure flag set cannot see explicitly called out in rfc , in fact section 8.5 states cookies not follow same restrictions scheme , path when accessed through document.cookie. gives example of path restrictions being ignored when accessed locally using document.cookie - though admittedly doesn't explicitly mention whether secure cookies can read javascript on non-https pages. err on cautious side , assume not secure javascript on http pages unless httponly flag set.

the other issue there nothing stop http page setting cookie, , overwriting existing one. again achieved intercepting http page response , adding set-cookie header, or using javascript on page of vulnerable xss. while might think overwriting cookie wouldn't cause many problems log in else example without person realising @ point might enter other private data under incorrect login.

of course https page vulnerable xss interception attacks mention issue on unsecured http (and i'm including poorly configured https in btw). additionally http pages typically handled less care users , developers alike , load insecure third party content without error. more vulnerable xss or other issues.

this not mention fact that, port number difference, http site intercepted , made https site phishing site in hope visitors happy server name , don't notice incorrect port.

and few issues can think of.

i advise not allowing http , https on same server name, suggest https everywhere , go far recommending hsts ensure this.