When a cookie is created, it can be for either for secure connections (https) only or for both secure and insecure (https and http) connections. While creating cookie, if the current url is http, the cookie is created for both secure and insecure connections. So when a secure url is hit, it considers the cookie in same domain and proceeds without abnormalities. But the reverse case is not. While creating cookie, if the current url is https, it creates the cookie for secure connections, so when a non secure url is hit, it treats the cookie as for another domain and cannot read it.
Most common example is losing session parameters when the protocol is changed for the first time. One work around is, while creating the cookie from a secure link, set the secure param to false. Or add another cookie with same id, and value but setSecure to false.
Cookie c = new Cookie("JSESSIONID",
ServletActionContext.getRequest().getSession().getId());
c.setSecure(false);
ServletActionContext.getResponse().addCookie(c);
