This is the kind of bug that makes me leery of frameworks and tall application stacks. Having to trust more than one layer of multithreaded code between an app

This is the kind of bug that makes me leery of frameworks and tall application stacks. Having to trust more than one layer of multithreaded code between an application and the kernel gets riskier with every layer. Also another reason not to mix the main application code with the authentication/authorization code. Setting security cookies should be done by dedicated code in a dedicated process to avoid this kind of interaction, and the load-balancer layer should filter the setting of security cookies from non-security backends to enforce it.