Lets say I am using a reverse proxy with URL rewriting that provides access to 2 different applications

`http://www.example.com/app1/` and `http://www.example.com/app2/`.

I don't want those applications to be able to get access to each other cookies, especially because I want to contain a potential XSS vulnerability to one application only. Is it sufficient to set the path of the cookies accordingly? The http-only flag is not set in this scenario.

If setting the cookie path is not enough, I would be interested which additional steps should be taken.