Browser & Web Performance · Senior · Question 56 of 75

Why doesn't `SameSite` protect against attacks from a compromised subdomain like `blog.example.com`?

1Subdomains can't set cookies
2SameSite only works on port 443
✓Correct answer: SameSite is about sites, and subdomains of example.com are the same site, so cookies are still sent

Explanation

Same-site attacks need other defenses: CSRF tokens, __Host- cookies, Fetch Metadata and careful subdomain hygiene.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.