CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What is the 'None' value for SameSite cookie attribute, and what security requirement must accompany it?
- A.SameSite=None explicitly opts out of same-site restrictions, allowing the cookie to be sent on all cross-site requests; the Secure attribute is mandatory alongside it (enforced by browsers since Chrome 80) - SameSite=None without Secure is rejected by modern browsers
- B.SameSite=None means the cookie uses no same-site restrictions; it can be set without any other conditions
- C.SameSite=None is the default for all cookies; it must be combined with HttpOnly to have any effect
- D.SameSite=None is equivalent to not setting SameSite, and is only valid for cookies under 100 bytes
Why A is correct
SameSite=None is necessary for cookies that must be sent on cross-site requests - third-party embeds, cross-site API calls, payment processor iframes, SSO flows between different domains. From Chrome 80, SameSite=None requires Secure to be set; otherwise the browser rejects the cookie. This pairing ensures that at minimum the cookie is only transmitted over HTTPS, even if it crosses site boundaries. This was a deliberate design choice: cross-site cookie transmission is only permitted over encrypted channels.
Know someone studying for Web App Fundamentals? Send them this one.