Same-Site vs Same-Origin

TL;DR: A site is the registrable domain (eTLD+1), so app.example.com and api.example.com are the same site but different origins. CORS cares about origin; SameSite cookies care about site.

Two URLs are same-site when they share a registrable domain, also called eTLD+1: the effective top-level domain plus one more label. The effective TLD comes from the Public Suffix List, a maintained list of suffixes under which anyone can register names. Same-site is a looser test than same-origin, and mixing the two up causes most SameSite and CORS confusion.

Worked examples

A	B	Same-site?	Same-origin?
https://app.example.com	https://api.example.com	Yes	No
https://example.com	https://example.com:8443	Yes	No
https://example.com	http://example.com	Depends (see below)	No
https://shop.example.co.uk	https://blog.example.co.uk	Yes	No
https://alice.github.io	https://bob.github.io	No	No

co.uk and github.io are both on the Public Suffix List, so example.co.uk and alice.github.io are the registrable domains, not co.uk or github.io. You cannot find this by counting dots; you need the list.

Where each one applies

GET /account HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Sec-Fetch-Site: same-site
Cookie: session=abc123

• Origin decides CORS. This request is cross-origin, so the response needs Access-Control-Allow-Origin.
• Site decides cookies. It is same-site, so a SameSite=Strict cookie is still attached.
• Sec-Fetch-Site is the request header that tells the server which relationship the browser computed: same-origin, same-site, cross-site or none.

Non-obvious facts

• The HTML Standard defines both “same site” (scheme must match) and “schemelessly same site”. Which one a feature uses varies, so http:// to https:// on the same domain is cross-site for some checks and same-site for others. Test in the browsers you support.
• Sibling subdomains are mutually trusted for SameSite purposes. An XSS hole on blog.example.com can send authenticated requests to app.example.com that SameSite will not block.
• Hosting platforms that give each customer a subdomain only stay safe because they are on the Public Suffix List.

Go deeper

• SameSite cookie attribute
• Origin
• CORS guide
• Cookie security guide