CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What does the SameSite cookie attribute protect against?
- A.SQL injection; authentication cookies are protected by the same origin policy alone, and marking one HttpOnly is what allows client side scripts to read and refresh it during a session
- B.XSS attacks
- C.Clickjacking, since a scanner proves an application is free of flaws when it returns no findings, and manual testing adds nothing once an automated scan has completed cleanly
- D.Cross-Site Request Forgery (CSRF) by controlling when cookies are sent with cross-origin requests
Why D is correct
SameSite controls cross-origin cookie behavior: 'Strict' never sends cookies cross-site, 'Lax' (default in modern browsers) sends cookies only for top-level navigations (GET), and 'None' (requires Secure flag) always sends cookies. Lax/Strict effectively prevent CSRF because the attacker's site cannot trigger cookie-authenticated requests.
Know someone studying for Security Fundamentals? Send them this one.