Site (Web)

web security

Definition

Site (Web)

The site of a URL is its registrable domain, computed as eTLD+1: take the eTLD and add exactly one more label to the left. The +1 picks up the single label a registrant controls, so further labels such as www or a project name are dropped — they name subdomains of the same registrant and do not change the site.

Two hosts belong to the same site iff they share a registrable domain:

Host	eTLD	eTLD+1 (site)
https://www.tuwien.ac.at	ac.at	tuwien.ac.at
https://old-project.tuwien.ac.at	ac.at	tuwien.ac.at
http://test.tuwien.ac.at	ac.at	tuwien.ac.at
https://lavish.github.io	github.io	lavish.github.io

The first three are the same site despite differing in scheme and host — they all reduce to the shared registrable domain tuwien.ac.at. By contrast lavish.github.io is its own site because the PSL lists github.io as an eTLD. All four are still different origins.

Same Site Is Coarser Than Same Origin

Same site is coarser than same origin

The SOP is origin-based, but several security mechanisms — the cookie Domain attribute, CORS, CSP, and postMessage trust decisions — use the coarser site boundary. A subdomain takeover lets the attacker escalate into the same site and undermine all of them. Site isolation in modern browsers explicitly does not mitigate cross-origin attacks within a site.

Example

Determining the site of four GitHub Pages URLs

The eTLD for github.io is github.io itself (it is listed on the Public Suffix List so that each user gets an isolated registrable domain). The registrable domain is therefore the next label, i.e. the username:

URL	eTLD	Registrable domain	Site relation
https://lavish.github.io	github.io	lavish.github.io	—
https://beerphilipp.github.io	github.io	beerphilipp.github.io	cross-site to the row above
https://test.tuwien.ac.at:8080	ac.at	tuwien.ac.at	unrelated site

So although lavish.github.io and beerphilipp.github.io look like two pages of the same service, they are different sites (and different origins), and a cookie set for one is not sent to the other. By contrast test.tuwien.ac.at:8080 and www.tuwien.ac.at are the same site despite differing in host and port — the registrable domain tuwien.ac.at is shared — though they are still different origins, so the SOP keeps their DOMs separate.