My Question is about Exercise 3 Question 1 (Called 1a) Countermeasures):
According to the solution provided, "Using Same-site cookies" Would be a countermeasure for clickjacking.
Maybe I'm missing something here, but to my understanding, Same-site cookies might prevent an attacker from stealing cookies, but it should not prevent clickjacking.
Example:
An attacker wants to make the user of good.com delete their account on this site.
The attacker can use clickjacking using invisible iframes (if no other prevention mechanism is used) to make the user click on a "Delete account" button. (Once again assuming there is no prevention mechanism for 1-click deletes :) )
Since the user is currently logged in (cookie is set) and the route for deleting their account might be along the lines of
http://good.com/account-delete (clearly same site to
http://good.com/some-other-route) the cookie should be sent while requesting the account-deletion route.
Hence, the user was made to do something they did not intend => Clickjacking
Please correct me if I overlooked something, but given the example above Same-site cookies alone would not prevent Clickjacking.