 <p>I've found what happens, and it can be usefull for others. @Mark Ormston was not so far : Cookies set with path /cas are send by IE10 to URL beginings with /cas-services</p> <p>In my case /cas and /cas-services are not in the same WebApp and each have its own JSESSIONID. Sending JSESSIONID created for /cas to /cas-services lead to the problem describe above.</p> <p>To correct, I simply rename /cas-services with /app-services (I guess that everything not beginning with /cas should work).</p> <p>JM.</p>