# Mixed Content warnings **URL:** \ **Category:** Product Support\ **Created:** [September 11, 2020, 10:01am UTC](https://meta.discourse.org/t/mixed-content-warnings/163727 "2020-09-11T10:01:27Z")\ **Posts on this page:** 1\ **Showing post:** 9
**Author:** ![JuergenAuer](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@JuergenAuer](https://meta.discourse.org/u/JuergenAuer)\ **Post date:** [September 11, 2020, 2:28pm UTC](https://meta.discourse.org/t/mixed-content-warnings/163727/9 "2020-09-11T14:28:49Z")
> [@supermathie](#): > > The browser isn’t sending its cookies for the forum site to another site, HTTP or HTTPS. That’s not the problem. That would be a browser bug. A man in the middle can add a cookie in the `http://alohadentalgroup.com` connection with the domain `alohadentalgroup.com`, with the known name of a session cookie (if exist, didn’t checked that) of that domain (not from the forum domain). If a user - later - uses the login of `https://alohadentalgroup.com` to manage that domain, that cookie (created via http) is sent back via https. This is one critical (and often unknown) cookie feature. That’s one reason Prefix cookies are created. Cookies starting with \_\_Secure- or \_\_Host-, https is required. Then this isn’t longer possible. Same with Preload (but most sites don’t use HSTS and aren’t preloaded). See (2017) > **[Securing cookies with cookie prefixes](https://www.sjoerdlangkemper.nl/2017/02/09/cookie-prefixes/)** > > Cookies can be overwritten by a man-in-the-middle attacker, even when using HTTPS. Using special cookie prefixes makes cookies more secure. or other links. PS: My “check your website” (see my profile) has a page with some samples. And a small demo. A cookie created via http and sent back via https. Via http it’s not possible (with a modern browser) to create the \_\_Host- cookie. But Prefix-Cookies are rare. --- _[View the full topic](https://meta.discourse.org/t/mixed-content-warnings/163727)._