The Browser Security Model: Same-Origin Policy, Origin vs Site, SameSite Cookies and Fetch Metadata
The Same-Origin Policy does not stop a cross-origin request, it only stops the response from being read; SameSite decides which cookies go with the request, and the server can reject it by looking at the Sec-Fetch-* headers. In this post we log the real behaviour of origin vs site, CORS, Strict/Lax/None cookies and Fetch Metadata headers from headless Chrome against an ASP.NET Core 10 lab, and build a Fetch Metadata policy with tests.
8 Nov 2026
·
13 min
·
4
