CEH Web Application and Injection Attacks Practice Question
A security analyst is reviewing HTTP response headers and notices the following: Set-Cookie: sessionId=abc123; SameSite=Lax. What is the primary purpose of the SameSite attribute?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To mitigate cross-site request forgery (CSRF) attacks
SameSite=Lax prevents the browser from sending the cookie in cross-site requests initiated by third-party websites, mitigating CSRF attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To enforce HTTPS for cookie transmission
Why it's wrong here
The SameSite cookie attribute does not control the transport layer security of cookie transmission. Its purpose is to restrict when a browser sends cookies in cross-site contexts, not to encrypt or secure the connection itself. The Secure flag is the specific attribute responsible for ensuring a cookie is only transmitted over an encrypted HTTPS connection, preventing interception and ensuring confidentiality.
- ✗
To prevent the cookie from being accessed by JavaScript
Why it's wrong here
The SameSite attribute is designed to control whether cookies are sent with cross-site requests, thereby mitigating certain types of attacks like CSRF. It does not, however, prevent client-side JavaScript from accessing the cookie's value. That specific security control is provided by the HttpOnly cookie attribute, which instructs the browser to make the cookie inaccessible to document.cookie API calls, protecting against XSS-based cookie theft.
- ✓
To mitigate cross-site request forgery (CSRF) attacks
Why this is correct
The SameSite cookie attribute directly addresses Cross-Site Request Forgery (CSRF) attacks by restricting when a browser sends cookies with cross-site requests. By setting SameSite to Lax or Strict, the browser will not attach the session cookie to requests originating from a different site, effectively preventing an attacker's forged request from being authenticated by the victim's browser. This significantly reduces the risk of unauthorized actions being performed on behalf of the user without their explicit intent.
- ✗
To ensure the cookie is only sent over HTTP and not FTP
Why it's wrong here
Cookies are an intrinsic part of the HTTP protocol, designed specifically for state management within web browsing sessions. Therefore, the SameSite attribute, like all other cookie attributes, operates exclusively within the HTTP/HTTPS context and has no relevance or function concerning other protocols like FTP. Cookies are not transmitted over FTP, making any attribute related to their transmission over FTP irrelevant to their security or functionality.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.