Web Security · Junior · Question 37 of 75
Are https://app.example.com and https://api.example.com the same origin?
- ✓Correct answer: No: the hosts differ, so they are different origins (but the same site)
- 2Yes, if both use port 443
- 3Yes, because they share
example.com
Explanation
Subdomains are separate origins. They are same-site, which matters for cookies and SameSite, but not for the same-origin policy.