What does SameSite cookie attribute help mitigate?

Question

Options

• ASQL Injection
• BCross-Site Request Forgery
• CReflected XSS
• DBrute Force Attacks

• A
  10% (2)
• B
  80% (16)
• C
  5% (1)
• D
  5% (1)

Explanation

SameSite is correct because it controls whether a browser sends a cookie along with cross-site requests - CSRF attacks work by tricking a victim's browser into making an authenticated request to another site, and SameSite=Strict or SameSite=Lax blocks that cookie from being sent, neutralizing the attack.

Why the others are wrong:

• SQL Injection (A) is mitigated by parameterized queries and input sanitization - cookies have no role there.
• Reflected XSS (C) is addressed by output encoding and Content Security Policy; the HttpOnly cookie flag can limit XSS impact, but SameSite itself doesn't block script injection.
• Brute Force (D) is handled by rate limiting, account lockout, and MFA - entirely unrelated to cookie policy.

Memory tip: Think "SameSite = Same Origin only" - if the request comes from a different site (cross-site), the cookie stays home. CSRF is precisely the attack where a foreign site forges a request on your behalf, so SameSite cuts it off at the source.

No community discussion yet for this question.