Let me explain the specification.
The definition of "same-site" is :
A request is "same-site" if its target's URI's origin's registered
domain is an exact match for the request's client's "site for
cookies", or if the request has no client. The request is otherwise
For a given request ("request"), the following ...
The SameSite policy still misses the mark for trustworthy cross-domain services.
Say I am browsing a site at firstparty.com which loads a script from mytrustedpartner.com to provide valuable functionality to my site.
The target URI’s “registered domain” must be an “exact match” for the request’s “site for cookies”.
You know what a “registered domain” is: The domain name you can buy or rent, i.e. one level below the public suffix.
The “site for cookies“ is usually the “registered domain” as well – here, of the request. This is true when the document is “in a top-level ...
The same origin policy does not prevent all authenticated cross site interactions. Specifically, cross origin writes and embeds are generally allowed, while reads are prevented:
Cross-origin writes are typically allowed. Examples are links, redirects, and form submissions.
Cross-origin embedding is typically allowed.
Cross-origin reads are ...
The 'Site' in SameSite refers to a the combination of second level domain mysite.com and top level domain mysite.com.
This means that a requests from login.mysite.com to cdn.mysite.com
would be considered a same-site request.
BUT... as you might imagine it does not end there. There is the Public Suffixes List which slightly changes this validation ...