Same-Site vs Cross-Site Requests

Understanding the difference between same-site and cross-site requests is fundamental to understanding cookie behavior, especially with the SameSite attribute.

Request Classification

Every HTTP request is classified as either same-site or cross-site based on the relationship between:

The domain that set the cookie
The domain making the request
The context of the request (top-level navigation vs embedded resource)

Same-Site Requests

A same-site request occurs when a request is made to the same domain where the cookie was originally set.

Definition

The cookie is sent whenever a request is made to the same domain it was set on. This is the default behavior for cookies.

Characteristics

Same Domain: Request is made to the exact domain that set the cookie
Subdomain Consideration: Depends on the Domain attribute:
- Cookie set with Domain=example.com → accessible by example.com and all subdomains
- Cookie set without Domain → only accessible by exact domain
Always Sent: Cookies are sent with same-site requests regardless of SameSite attribute value
Default Behavior: This is how cookies work by default (unless restricted by SameSite)

Examples

Scenario 1: Same Domain

User visits https://shop.example.com
Server sets cookie: Set-Cookie: session=abc123; Domain=shop.example.com
User navigates to https://shop.example.com/products
Result: Cookie is sent (same-site request)

Scenario 2: Subdomain (with Domain Attribute)

User visits https://shop.example.com
Server sets cookie: Set-Cookie: session=abc123; Domain=example.com
User navigates to https://blog.example.com
Result: Cookie is sent (same-site request, because cookie Domain matches)

Scenario 3: API Request

User visits https://shop.example.com
Cookie exists: session=abc123; Domain=shop.example.com
JavaScript makes request: fetch('https://shop.example.com/api/cart')
Result: Cookie is sent (same-site request)

Cross-Site Requests

A cross-site request occurs when a request is made to a different domain than where the cookie was set.

Important Distinction

Cross-site requests are further classified by:

HTTP Method: GET vs POST
Request Context: Top-level navigation vs embedded resource

The behavior differs significantly based on these factors.

Cross-Site GET Requests

The cookie is sent if the user clicks a link on an external website that navigates them to the cookie's site using the GET method.

Definition

Cross-site GET requests that represent top-level navigation will include cookies (depending on SameSite attribute).

Characteristics

GET Method: Uses HTTP GET method
Top-Level Navigation: Changes the browser's main window/tab URL
User Initiated: Usually triggered by user clicking a link
SameSite=Lax: Cookies with SameSite=Lax are sent with cross-site GET navigations
SameSite=Strict: Cookies with SameSite=Strict are NOT sent

Examples

Scenario 1: Link Click

User visits https://external-site.com
Page contains link: <a href="https://shop.example.com/products">Visit Shop</a>
User clicks the link
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Lax
Result: Cookie is sent with request to shop.example.com (cross-site GET navigation)

Scenario 2: Redirect

User visits https://external-site.com
Server redirects: 301 Redirect to https://shop.example.com/welcome
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Lax
Result: Cookie is sent with redirect request (cross-site GET navigation)

Scenario 3: GET Form Submission

User visits https://external-site.com
Form on page: <form method="GET" action="https://shop.example.com/search">
User submits form
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Lax
Result: Cookie is sent (cross-site GET navigation)

Scenario 4: SameSite=Strict

User visits https://external-site.com
User clicks link to https://shop.example.com/products
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Strict
Result: Cookie is NOT sent (SameSite=Strict blocks cross-site requests)

Cross-Site POST Requests

The cookie is not sent with cross-site requests that use the POST method, such as when submitting a form on another website.

Definition

Cross-site POST requests do not include cookies, even for top-level navigation, unless the cookie has SameSite=None.

Characteristics

POST Method: Uses HTTP POST method
Form Submissions: Usually from submitting forms on external sites
No Cookies by Default: Cookies are NOT sent with cross-site POST requests
SameSite=Lax: Cookies with SameSite=Lax are NOT sent with cross-site POST
SameSite=Strict: Cookies with SameSite=Strict are NOT sent with cross-site POST
SameSite=None: Cookies with SameSite=None are sent (if also Secure)

Examples

Scenario 1: Form Submission

User visits https://external-site.com
Form on page: <form method="POST" action="https://shop.example.com/login">
User submits form
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Lax
Result: Cookie is NOT sent (cross-site POST request)

Scenario 2: AJAX POST

User visits https://external-site.com
JavaScript makes request: fetch('https://shop.example.com/api/data', { method: 'POST' })
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=Lax
Result: Cookie is NOT sent (cross-site POST request, not top-level navigation)

Scenario 3: SameSite=None

User visits https://external-site.com
Form on page: <form method="POST" action="https://shop.example.com/login">
User submits form
Cookie exists: session=abc123; Domain=shop.example.com; SameSite=None; Secure
Result: Cookie IS sent (SameSite=None allows cross-site POST)

Request Type Comparison

Same-Site Requests

Request Type	Cookie Sent?	Notes
Same domain GET	✅ Yes	Default behavior
Same domain POST	✅ Yes	Default behavior
Same domain AJAX	✅ Yes	Default behavior
Subdomain GET	✅ Yes	If Domain attribute allows
Subdomain POST	✅ Yes	If Domain attribute allows

Cross-Site Requests

Request Type	SameSite=Lax	SameSite=Strict	SameSite=None
GET Navigation	✅ Yes	❌ No	✅ Yes
POST Form	❌ No	❌ No	✅ Yes
AJAX/Fetch	❌ No	❌ No	✅ Yes
Image/Pixel	❌ No	❌ No	✅ Yes
Iframe	❌ No	❌ No	✅ Yes

Visual Flow Diagrams

Same-Site Request Flow

sequenceDiagram participant User participant Browser participant SiteA as Site A
(example.com) Note over User,SiteA: Cookie set: session=abc#59; Domain=example.com User->>Browser: Navigate to example.com/products Browser->>Browser: Check: Request domain = Cookie domain? Browser->>Browser: ✅ YES - Same-site request Browser->>SiteA: GET /products
Cookie: session=abc SiteA->>Browser: HTTP 200 OK
Content: Products page

Cross-Site GET Request Flow

sequenceDiagram participant User participant Browser participant ExternalSite as External Site
(external.com) participant SiteA as Site A
(example.com) Note over Browser,SiteA: Cookie set: session=abc#59; Domain=example.com#59; SameSite=Lax User->>Browser: Visit external.com Browser->>ExternalSite: GET /page ExternalSite->>Browser: HTML with link to example.com User->>Browser: Click link to example.com Browser->>Browser: Check: Request domain ≠ Cookie domain? Browser->>Browser: ✅ YES - Cross-site request Browser->>Browser: Check: GET navigation + SameSite=Lax? Browser->>Browser: ✅ YES - Send cookie Browser->>SiteA: GET /products
Cookie: session=abc SiteA->>Browser: HTTP 200 OK
Content: Products page

Cross-Site POST Request Flow

sequenceDiagram participant User participant Browser participant ExternalSite as External Site
(external.com) participant SiteA as Site A
(example.com) Note over Browser,SiteA: Cookie set: session=abc#59; Domain=example.com#59; SameSite=Lax User->>Browser: Visit external.com Browser->>ExternalSite: GET /page ExternalSite->>Browser: HTML with POST form to example.com User->>Browser: Submit form to example.com Browser->>Browser: Check: Request domain ≠ Cookie domain? Browser->>Browser: ✅ YES - Cross-site request Browser->>Browser: Check: POST method + SameSite=Lax? Browser->>Browser: ❌ NO - Don't send cookie Browser->>SiteA: POST /login
Cookie: (none) SiteA->>Browser: HTTP 200 OK
Content: Login page

SameSite Attribute Impact

SameSite=Lax (Default in Modern Browsers)

Behavior:

✅ Same-site requests: Cookie sent
✅ Cross-site GET navigation: Cookie sent
❌ Cross-site POST: Cookie NOT sent
❌ Cross-site AJAX/embedded resources: Cookie NOT sent

Use Case: Most common setting for authentication cookies. Provides CSRF protection while allowing natural navigation.

SameSite=Strict

Behavior:

✅ Same-site requests: Cookie sent
❌ Cross-site GET navigation: Cookie NOT sent
❌ Cross-site POST: Cookie NOT sent
❌ Cross-site AJAX/embedded resources: Cookie NOT sent

Use Case: Maximum security. User must visit site directly or from same-site context.

SameSite=None

Behavior:

✅ Same-site requests: Cookie sent
✅ Cross-site GET navigation: Cookie sent
✅ Cross-site POST: Cookie sent
✅ Cross-site AJAX/embedded resources: Cookie sent

Requirements: Must also include Secure attribute (HTTPS only).

Use Case: Third-party cookies for tracking, advertising, embedded widgets.

Testing Scenarios

Test 1: Same-Site Request

Visit https://site-a.cookie-playground.pun7o.click
Set cookie: test=value1; Domain=site-a.cookie-playground.pun7o.click
Navigate to https://site-a.cookie-playground.pun7o.click/index.html
Expected: Cookie is sent (same-site request)

Visit https://site-b.cookie-playground.pun7o.click
Set cookie: test=value2; Domain=site-a.cookie-playground.pun7o.click; SameSite=Lax
Click link from subdomain B to subdomain A
Expected: Cookie is sent (cross-site GET navigation with SameSite=Lax)

Test 3: Cross-Site POST

Visit https://site-b.cookie-playground.pun7o.click
Set cookie: test=value3; Domain=site-a.cookie-playground.pun7o.click; SameSite=Lax
Submit POST form from subdomain B to subdomain A
Expected: Cookie is NOT sent (cross-site POST blocked by SameSite=Lax)

Test 4: Cross-Site Pixel Request

Visit https://site-b.cookie-playground.pun7o.click
Set cookie: test=value4; Domain=site-a.cookie-playground.pun7o.click; SameSite=Lax
Load pixel: <img src="https://site-a.cookie-playground.pun7o.click/pixel">
Expected: Cookie is NOT sent (embedded resource, not top-level navigation)

Key Takeaways

Same-Site Requests

Definition: Request to same domain where cookie was set
Behavior: Cookie sent by default (default behavior)
Examples: Direct navigation, API calls, AJAX requests to same domain

Cross-Site GET Requests

Definition: GET request to different domain (top-level navigation)
Behavior: Cookie sent if SameSite=Lax or SameSite=None
Examples: Clicking links, redirects, GET form submissions

Cross-Site POST Requests

Definition: POST request to different domain
Behavior: Cookie NOT sent unless SameSite=None
Examples: Form submissions, AJAX POST requests

Security Implications

CSRF Protection: SameSite=Lax provides protection against cross-site POST attacks
User Privacy: SameSite=Strict provides maximum privacy protection
Tracking: SameSite=None allows cross-site tracking (increasingly restricted by browsers)

Learn about Cookie Attributes for detailed SameSite behavior
Understand First-Party vs Third-Party cookies
Explore Cross-Domain Behavior for subdomain scenarios
Review HTTP Headers for Set-Cookie header details

Same-Site vs Cross-Site Requests

Request Classification

Same-Site Requests

Definition

Characteristics

Examples

Cross-Site Requests

Important Distinction

Cross-Site GET Requests

Definition

Characteristics

Examples

Cross-Site POST Requests

Definition

Characteristics

Examples

Request Type Comparison

Same-Site Requests

Cross-Site Requests

Visual Flow Diagrams

Same-Site Request Flow

Cross-Site GET Request Flow

Cross-Site POST Request Flow

SameSite Attribute Impact

SameSite=Lax (Default in Modern Browsers)

SameSite=Strict

SameSite=None

Testing Scenarios

Test 1: Same-Site Request

Test 2: Cross-Site GET Navigation

Test 3: Cross-Site POST

Test 4: Cross-Site Pixel Request

Key Takeaways

Same-Site Requests

Cross-Site GET Requests

Cross-Site POST Requests

Security Implications

Related Topics