Origin vs. Site: What Actually Differs
"Same-site" and "same-origin" get thrown around a lot when talking about page transitions, fetch() requests, cookies, popups, embedded resources, and iframes. Despite sounding similar, they define different scopes. Getting them straight matters because browser security decisions often depend on which one applies.
An origin is the full combination of scheme (protocol), hostname, and port. Given the URL https://www.example.com:443/foo, the origin is https://www.example.com:443. Two resources are "same-origin" only when all three components match exactly; otherwise they are "cross-origin".
A site is broader. It combines the scheme with the registrable domain — the TLD plus the label immediately before it, often called TLD+1. For https://www.example.com:443/foo, the site is https://example.com. Subdomains such as www or api are ignored for site comparison, but they matter for origin comparison.
How eTLDs Change Site Calculation
Plain TLDs like .com and .org are listed in the IANA Root Zone Database. But for domains with suffixes like .co.jp or .github.io, a simple TLD+1 rule breaks down. There is no algorithmic way to tell which part of such a domain is registrable, so browsers rely on the Public Suffix List. That list defines effective TLDs (eTLDs), maintained at publicsuffix.org/list.
For example, with https://www.project.github.io:443/foo, the eTLD is .github.io and the eTLD+1 is project.github.io. The site is therefore https://project.github.io.
Two resources are "same-site" if they share the same scheme and the same eTLD+1. A difference in either makes them "cross-site".
Schemeful vs. Schemeless Same-Site
The definition of "same-site" was tightened to include the URL scheme. That change prevents HTTP from being used as a weak channel to bypass site-based security boundaries. The older definition, which ignored the scheme, is now called schemeless same-site. Under that older rule, http://www.example.com and https://www.example.com are schemeless same-site, but they are not same-site under the modern schemeful definition because their schemes differ.
Checking Request Context with Sec-Fetch-Site
Browsers send a Sec-Fetch-Site HTTP header with every request, indicating one of four values:
cross-sitesame-site(refers to schemeful same-site)same-originnone
The header is reliable for determining request context. HTTP headers with the Sec- prefix cannot be modified by JavaScript, and the browser always sets the value.
