CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What does the SameSite cookie attribute protect against?
- A.A. XSS attacks
- B.D. Clickjacking
- C.C. SQL injection
- D.B. Cross-Site Request Forgery (CSRF) by controlling when cookies are sent with cross-origin requests
Why D is correct
SameSite controls cross-origin cookie behavior: 'Strict' never sends cookies cross-site, 'Lax' (default in modern browsers) sends cookies only for top-level navigations (GET), and 'None' (requires Secure flag) always sends cookies. Lax/Strict effectively prevent CSRF because the attacker's site cannot trigger cookie-authenticated requests.
Know someone studying for Security Fundamentals? Send them this one.