BY PASSING SAME SITE COOKIE RESTRICTIONS VIA FEDERATED AUTHENTICATION AND SUBDOMAIN CONTROL EXPLOITS

Abstract

Browser-based security models are widely used to access digital services in a secure manner, and HTTP cookies remain a fundamental component of web application secu rity. The introduction of SameSite cookie protection mechanisms has been adopted by modern browsers to enhance browser security and minimize risks related to Cross-Site Request Forgery (CSRF) and unauthorized cross-site interactions. However, newer authentication architectures introduce cross-domain interactions through federated au thentication standards such as OAuth, OpenID Connect, and Single Sign-On, which may weaken or complicate the intended security guarantees of cookie-based protec tions. In addition to federated authentication flows, trust relationships between organizational subdomains can create security weaknesses when subdomains are poorly managed, misconfigured, or exposed to attacker control. This research examines the possibility of circumventing SameSite cookie restrictions through the combined effect of feder ated authentication workflows and trusted subdomain control scenarios. A controlled experimental framework was developed to simulate authentication interactions, redi rection manipulation, cookie transmission behavior, and subdomain exploitation under ethical testing conditions. Several browsers were tested to understand how consistently they implement SameSite enforcement and how effectively they resist exploitation under different authentication conditions. The study highlights that SameSite cookies provide an important layer of protection, but their effectiveness depends on correct configuration, secure identity provider integration, and careful management of subdomain trust boundaries. The findings emphasize the need for layered browser security, strict redirect validation, robust subdomain governance, and defence-in-depth strategies for securing modern web authentication systems.