Match the descriptions to these browser protections terms: Content Security Policy, HttpOnly, Secure cookie attribute, SameSite.

Browser protectionsConcept relationships

Choose a match for every item. Use each answer once.

CSP adds defense in depth but does not replace safe handling of untrusted content.

SameSite reduces some CSRF exposure, with behavior depending on the selected mode and request context.

Secure cookies reduce exposure over plaintext connections and should accompany HTTPS deployment.

HttpOnly limits direct cookie theft through script access but does not stop every action an injected script could perform.